George, a professional hacker, targeted a bank employee and tried to crack his password while he was attempting to log on to the remote server to…

The scenario describes a classic offline dictionary or brute-force attack against a Wi-Fi network's Pre-Shared Key (PSK). This attack is characteristic of the WPA2 protocol. The attacker captures the WPA2 4-way handshake frames exchanged between the client and the access point. The Pairwise Master Key (PMK) is derived from the PSK (the Wi-Fi password). By capturing the handshake, the attacker can use computational power to guess the PSK offline. A correct guess will allow the attacker to independently compute the same PMK and subsequent keys, thereby validating the guess and cracking the password. This specific vulnerability is a well-documented weakness of WPA2-PSK.

A. WPA3: WPA3 uses the Simultaneous Authentication of Equals (SAE) handshake, which is specifically designed to be resistant to the offline dictionary attacks described in the scenario.
B. WPA: While WPA also uses a 4-way handshake and is vulnerable, WPA2 is the more precise answer as it standardized the use of the stronger AES-CCMP cipher and is the protocol most famously associated with this attack vector.
D. WEP: WEP does not use a 4-way handshake or a Pairwise Master Key (PMK). Its cryptographic weaknesses are fundamentally different, related to its use of the RC4 stream cipher and short, reused Initialization Vectors (IVs).

1. Vanhoef, M., & Piessens, F. (2017). Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. Section 2.2, "4-Way Handshake," describes the process where the PMK is used to generate session keys, and notes that with WPA2-Personal, the PMK is derived directly from a pre-shared password. This forms the basis for offline dictionary attacks. (DOI: https://doi.org/10.1145/3133956.3134028)

2. Boneh, D. (2020). CS 155: Computer and Network Security, Lecture 13: Network Security. Stanford University. Slide 51 explicitly states, "WPA2-PSK: Attacker can capture 4-way handshake and mount an offline dictionary attack on the PSK." This directly confirms the attack method described in the question is applicable to WPA2. (Available via Stanford University course archives).

3. IEEE Std 802.11i-2004. (2004). IEEE Standard for Information technology—Telecommunications and information exchange between systems—Local and metropolitan area networks—Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications Amendment 6: Medium Access Control (MAC) Security Enhancements. Section 8.5.3, "The 4-Way Handshake," details the protocol exchange that an attacker can capture to perform an offline attack.