What is OWE?

Opportunistic Wireless Encryption (OWE) provides encryption for open Wi-Fi networks without requiring users to enter a Wi-Fi password.

Traditional open Wi-Fi networks do not encrypt the wireless connection between a client and the access point. OWE improves security by allowing supported clients to establish an individual encrypted connection with the access point.

OWE is also commonly referred to as Wi-Fi Enhanced Open.

Unlike WPA2-Personal or WPA3-Personal, OWE does not require a Pre-Shared Key (PSK) or password. Users can continue to connect without entering a Wi-Fi password while supported devices benefit from wireless encryption.

OWE on Alta Labs Access Points

OWE can be used with an SSID configured with Open Wi-Fi security.

On 2.4 GHz and 5 GHz, both WPA3 and Protected Management Frames (PMF) must be enabled for OWE. Either setting may be configured as On or Required; the specific combination does not matter as long as neither setting is disabled.

To view or configure these settings:

1. Navigate to Settings → WiFi.
2. Select an existing SSID or select Add New to create one.
3. Under WiFi Security, select Open.
4. Expand Advanced settings.
5. Set WPA3 to On or Required.
6. Set PMF to On or Required.
7. Select Save after making any changes.

No Wi-Fi password is required for clients to connect when OWE is enabled.

OWE on 2.4 GHz and 5 GHz

When OWE is enabled for an Open SSID on the 2.4 GHz or 5 GHz bands, Alta Labs access points also provide a traditional Open BSSID for compatibility with devices that do not support OWE.

This allows:

• OWE-capable clients to establish an encrypted wireless connection.
• Clients without OWE support to continue connecting using a traditional, unencrypted Open connection.

The traditional Open BSSID does not use OWE encryption or Protected Management Frames.

As a result, enabling OWE on 2.4 GHz or 5 GHz improves security for compatible clients without preventing older or incompatible clients from connecting.

How OWE Differs From a Traditional Open Network

On 2.4 GHz and 5 GHz, both connection types can be available for the same Open SSID. The type of connection used depends on whether the client supports OWE.

Client Support

OWE requires support from the connecting Wi-Fi client.

Modern devices that support Wi-Fi Enhanced Open/OWE can automatically establish an encrypted connection without requiring additional configuration or a password from the user.

On 2.4 GHz and 5 GHz, devices that do not support OWE can use the traditional Open BSSID instead.

Client behavior may vary depending on the operating system, Wi-Fi adapter, and driver in use.

OWE and 6 GHz Wi-Fi

Open Wi-Fi operates differently on the 6 GHz band because traditional unencrypted Open connections are not permitted.

When an Open SSID is configured to use 6 GHz on an Alta Labs access point, the Controller automatically enables the WPA3 and PMF settings required for OWE. The user does not need to enable these settings manually.

This allows the SSID to remain passwordless while providing the encryption required for an Open network operating on 6 GHz.

Unlike 2.4 GHz and 5 GHz, a traditional unencrypted Open BSSID is not provided on 6 GHz.