Subject: RE: [Capwap] Proposed Resolution to Issue 42 - PMK Sharing

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 13 Apr 2006 06:18:22 -0700

Similar comment. I never understood the original issue, other than
saying that
sharing is a bad thing - regardless of whether the protocol does it or
not.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> -----Original Message-----
> From: T. Charles Clancy [mailto:[email-masked]] 
> Sent: Monday, April 10, 2006 12:27 PM
> To: Dorothy Stanley
> Cc: capwap
> Subject: Re: [Capwap] Proposed Resolution to Issue 42 - PMK Sharing
> 
> This was my original point -- CAPWAP doesn't let you share 
> the PMK, so I never understood why this was an issue.
> 
> [ t. charles clancy ]--[ [email-masked] ]--[ 
> www.cs.umd.edu/~clancy ] [ computer science ]-----[ 
> university of maryland | college park ]
> 
> 
> On Mon, 10 Apr 2006, Dorothy Stanley wrote:
> 
> > All,
> >
> > Issue 42 - PMK Sharing has the following discussion in the 
> issues data base:
> >
> > Issue:
> >
> > In the case of an AC managing a same PMK across many WTPs, 
> IEEE 802.11 
> > stations cannot distinguish between PMKs that are validly 
> shared and 
> > those that have been compromised (I0 of Issues/Recommendations).
> >
> > My recommendation:
> >
> > Include text in the Security Considerations 
> > (draft-ohara-capwap-lwapp-03.txt) Section 15 along the lines;
> >
> > "The CAPWAP protocol may be used in scenarios in which an 
> AC manages a 
> > PMK across many WTPs. In such scenarios, IEEE 802.11 
> stations moving 
> > across WTPs cannot distinguish between PMKs that are legitimately 
> > shared and PMKs that have been compromised.
> > The CAPWAP WG recognizes this ambiguity and recommends 
> implementers of 
> > the protocol to review the outcome of IEEE 802.11r efforts 
> for resolution."
> >
> > No agreement on this request
> >
> >
> > Perhaps we need further clarification on what "manages a PMK across 
> > many WTPs" means.
> > If "manages a PMK across many WTPs" means that it delivers 
> the PMK to 
> > more than one WTP, then:
> >
> > It is not clear that the CAPWAP specification, current draft  does 
> > indeed provide a mechanism to deliver the PMK to the WTPs, to share 
> > the PMK across WTPs.  Below are the message elements that deliver 
> > keys:
> > - The IEEE 802.11 Add WLAN message element (11.8.1.1) - typically 
> > delivers the GTK
> > - The IEEE 802.11 Mobile Session Key message element (11.7.1.2) 
> > delivers a session key, the PTK
> > - The IEEE 802.11 Update WLAN message element (11.8.1.3)  - 
> typically 
> > delivers the GTK
> >
> > CAPWAP does support the ability to securely deliver the GTK and PTK 
> > from the AC to a WTP.
> > CAPWAP supports a secure control interface, requiring mutual 
> > authentication between the AC and  WTPs that are connected to it.
> >
> > Recommended resolution:
> > Reject the comment, with the reason that "An implementation which 
> > delivers PMKs to WTPs is not in compliance with the CAPWAP protocol"
> >
> > and change the text in 11.8.1.1 and 11.8.1.3 describing the 
> key that 
> > is delivered from:
> > "Key: A 32 byte Session Key to use with the encryption policy" to
> > "Key: A 32 byte key to use with the encryption key, 
> typically the GTK"
> >
> > Comments, discussion please.
> >
> > Thanks,
> >
> > Dorothy
> >
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/capwap
> 
> Archives: http://lists.frascone.com/pipermail/capwap
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Saravanan Govindan" <[email-masked]>
Date: Thu, 13 Apr 2006 22:37:44 +0800

All,

This issue goes back to the Architecture Taxonomy. I remember it coming up 
in a security review for the document. Subsequently, someone in the group 
wanted to see reference to it in CAPWAP documents - even if the reference 
was to say that it was not within the scope of CAPWAP.

This is the basis for the original proposal - reference followed by 
out-of-scope disclaimer.

Saravanan

----Original Message Follows----
From: "Pat Calhoun (pacalhou)" <[email-masked]>
To: "T. Charles Clancy" <[email-masked]>,"Dorothy Stanley" 
<[email-masked]>
CC: capwap <[email-masked]>
Subject: RE: [Capwap] Proposed Resolution to Issue 42 - PMK Sharing
Date: Thu, 13 Apr 2006 06:18:22 -0700

Pat Calhoun

_________________________________________________________________
Find just what you are after with the more precise, more powerful new MSN 
Search. http://search.msn.com.sg/ Try it now.