WPA 2 can be cracked using Aircrack-ng in Kali Linux. Is there any other security protocol for Wi-Fi which is not compromised?

EDIT/UPDATE 2017-10-17: This answer does not account for KRACK. That's an attack on both WPA2-PSK and WPA2-Enterprise. There's ways to detect and mitigate it, but they're not covered here.



You need to make a difference here. There's multiple things to consider. Also "WPA2" isn't precise enough – there's WPA2-PSK (pre-shared key), and WPA2-Enterprise (which relies on an external auth server)

1. The attacker wants to gain access to traffic or network, but is not in possession of the credentials to enter

Well, bad luck. WPA2, both PSK and Enterprise protect well against that, unless the credentials are easy to guess. And that's not a "brokenness" on part of the system – if you used your user name as login to a website, you really can't blame the website for being "easy to crack".

So, in this respect, WPA2 is utterly secure (as long as you don't use WPS, but your question is about hotspots, so that's pretty surely not the case).

2. The attacker is already part of the network and now wants to read other user's traffic

That's an especially relevant attack scenario for hotspots – getting access to the network might be as simple as buying a cup of coffee in cash.

So. Let's make a difference here:

2.1. Hotspot uses WPA2-Enterprise

You log on to the hotspot, proving (securely) that you know the credentials. The access point checks that in cooperation with an authentication server (802.1x). The authentication server generates a secret that is cryptographically secure enough to base your communication with the Access Point on. Every user gets a different key for encrypting their traffic. No user can spy on other users.

WPA2-enterprise is not "broken" in any sense of the word.

2.2. Hotspot uses WPA2-PSK

You log onto the access point, proving that you know the PSK. The access point generates, in cooperation with you, a secret key with which you encrypt and decrypt traffic between you and the hotspot. 

Other users do the same: prove that they know (the same) PSK, then generate a secret for their traffic crypto.

So, in a first look at the system, this is just as secure as WPA2-Enterprise.

HOWEVER: Due to weaknesses in the way the user-AP secret keys are generated, it's very easy for someone who already has one of these keys (which being logged on to the cafe's AP guarantees) and knows the PSK (which every user of your favourite coffee shop does) to recover the secret user-AP key of someone else by observing but a couple packets, totally passive.

That is a serious design flaw. 

Hence, WPA2-PSK is "broken" in the sense that it doesn't protect users of a WiFi network against spying by other legitimate users of the same network. @Josef and I aren't in full agreement whether that is "by design" or really "brokenness".

In any case, what you should take away from this is: whenever you're on a WiFi that uses the same key for everyone, your traffic can be read by everyone else on the network.

Is there any other security protocol for Wi-Fi which is not compromised?

Use WPA2-Enterprise. You will need to set up a 802.1x server (typically, radius or something equivalent), and that can be a hassle, but if you own an Access Point and want to provide secure access to everyone, that's your only choice. And it's not that complicated, at all. 

If you're just a user of a wifi, old saying says:


Trust no-one else's infrastructure. Use encryption.


In other words, if you're on a network where you can't trust other users, you might as well not trust the Access Point, which has the job of deciphering your WiFi traffic...

Use a VPN whenever you're on someone else's network. That's standard etiquette.
