Subject: [Capwap] Proposed Resolution to Issue 42 - PMK Sharing

From: "Dorothy Stanley" <[email-masked]>
Date: Mon, 10 Apr 2006 09:54:42 -0700

All,

Issue 42 - PMK Sharing has the following discussion in the issues data base:

Issue:

In the case of an AC managing a same PMK across many WTPs, IEEE 802.11
stations cannot distinguish between PMKs that are validly shared and those
that have been compromised (I0 of Issues/Recommendations).

My recommendation:

Include text in the Security Considerations (draft-ohara-capwap-lwapp-03.txt)
Section 15 along the lines;

"The CAPWAP protocol may be used in scenarios in which an AC manages a PMK
across many WTPs. In such scenarios, IEEE 802.11 stations moving across WTPs
cannot distinguish between PMKs that are legitimately shared and PMKs that
have been compromised.
The CAPWAP WG recognizes this ambiguity and recommends implementers of the
protocol to review the outcome of IEEE 802.11r efforts for resolution."

No agreement on this request

Perhaps we need further clarification on what "manages a PMK across many
WTPs" means.
If "manages a PMK across many WTPs" means that it delivers the PMK to more
than one WTP, then:

It is not clear that the CAPWAP specification, current draft  does indeed
provide a mechanism to deliver
the PMK to the WTPs, to share the PMK across WTPs.  Below are the message
elements that deliver keys:
- The IEEE 802.11 Add WLAN message element (11.8.1.1) - typically delivers
the GTK
- The IEEE 802.11 Mobile Session Key message element (11.7.1.2) delivers a
session key, the PTK
- The IEEE 802.11 Update WLAN message element (11.8.1.3)  - typically
delivers the GTK

CAPWAP does support the ability to securely deliver the GTK and PTK from the
AC to a WTP.
CAPWAP supports a secure control interface, requiring mutual authentication
between the AC and  WTPs that are connected to it.

Recommended resolution:
Reject the comment, with the reason that
"An implementation which delivers PMKs to WTPs is not in compliance with the
CAPWAP protocol"

and change the text in 11.8.1.1 and 11.8.1.3 describing the key that is
delivered from:
"Key: A 32 byte Session Key to use with the encryption policy" to
"Key: A 32 byte key to use with the encryption key, typically the GTK"

Comments, discussion please.

Thanks,

Dorothy
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "T. Charles Clancy" <[email-masked]>
Date: Mon, 10 Apr 2006 15:27:20 -0400 (EDT)

This was my original point -- CAPWAP doesn't let you share the PMK, so I 
never understood why this was an issue.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]