Subject: [Capwap] Issue 43 - IEEE 802.11i Encryption

From: "Saravanan Govindan" <[email-masked]>
Date: Thu, 13 Apr 2006 13:46:27 +0800

Hi All,

Following from the note below, would appreciate comments on the
resolution of Issue 43 - handling IEEE 802.11i encryption in WTP
designs. 

Saravanan

 

________________________________

From: Saravanan Govindan [mailto:[email-masked]] 
Sent: Friday, March 03, 2006 6:25 PM
To: [email-masked]
Subject: [Capwap] IEEE 802.11i - Encryption

All,

For the IEEE 802.11 binding, the protocol deals with split-MAC and
local-MAC architectures. For both types, there is the design case of
having encryption at the WTP and authenticator at the AC. This design
case is a mandatory requirement from the Objectives. I think there was a
discussion about this in the last meeting. 

I suggest adding new Key Configuration & Key Configuration Response
messages to 11.8 "802.11 Control Messages" in the IEEE 802.11 bindings
section and describing the exchange in new subsections 11.8.4 to 11.8.5.

The suggested text follows;

----0000----

11.8.4      IEEE 802.11 Key Configuration

The IEEE 802.11 Key Configuration CAPWAP message is used in WTP designs
in which IEEE 802.11i authenticator functions are performed by the AC
and IEEE 802.11i cryptographic functions (encryption/decryption) are
performed by the WTPs. 

This CAPWAP message is sent from the AC to the WTP. It must contain
either of the following 2 message elements. 

 

11.8.4.1     IEEE 802.11 4-way Handshake

The IEEE 802.11 4-way Handshake message element is sent by the AC to the
WTP during the 4-way handshake. It contains Message-3 of the 4-way
handshake with unassigned values as the AC is unaware of the prevailing
KeyRSC sequence counter maintained by the WTP.  

Message-1, Message-2 and Message-4 of the 4-way handshake are
transported within CAPWAP data packets between AC and WTP. 

The IEEE 802.11 4-way Handshake message element contains the following
values:

      0                   1                   2                   3

      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     |    GTK-Flag   |                   Reserved                    |

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     |                        Encryption-Data                        |

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     |                          EAPoL-Frame                          |

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

GTK-Flag: An 8-bit flag that determines the type of KeyMIC calculation

     0 - New GTK, KeyMIC is calculated with KeyRSC = 0

     1 - Existing GTK, KeyMIC is calculated with prevailing KeyRSC value

Encryption-Data: Contains PTK and/or GTK

EAPoL-Frame: Contains Message-3 of 4-way handshake with unassigned
fields

Upon receipt of the Key Configuration message from the AC, the WTP
performs the following operations:

    i.            Assigns the corresponding value to the KeyRSC field of
the EAPoL-Frame 

ii.            Calculates KeyMIC with Encrytion-Data and KeyRSC

iii.            Updates Message-3 of 4-way handshake

iv.            Continues regular 4-way handshake with wireless terminals

 

11.8.4.2     IEEE 802.11 Group Key Handshake

The IEEE 802.11 Group Key Handshake message element is sent by the AC to
the WTP during the group key handshake. It contains Message-1 of the
group key handshake with unassigned values as the AC is unaware of the
prevailing KeyRSC sequence counter maintained by the WTP.  

Message-2 of the group key handshake is transported within a CAPWAP data
packet between AC and WTP. 

The IEEE 802.11 Group Key Handshake message element contains the
following values:

      0                   1                   2                   3

      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     |    GTK-Flag   |                   Reserved                    |

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     |                        Encryption-Data                        |

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     |                          EAPoL-Frame                          |

     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

GTK-Flag: An 8-bit flag that determines the type of KeyMIC calculation

     0 - New GTK, KeyMIC is calculated with KeyRSC = 0

     1 - Existing GTK, KeyMIC is calculated with prevailing KeyRSC value

Encryption-Data: Contains PTK and/or GTK

EAPoL-Frame: Contains Message-1 of group key handshake with unassigned
fields

Upon receipt of the Key Configuration message from AC, the WTP performs
the following operations:

    i.            Assigns the corresponding value to the KeyRSC field of
the EAPoL-Frame 

ii.            Calculates KeyMIC with Encrytion-Data and KeyRSC

iii.            Updates Message-1 of group key handshake

iv.            Continues regular group handshake with wireless terminals

 

11.8.5     IEEE 802.11 Key Configuration Response

The IEEE 802.11 Key Configuration Response CAPWAP message is sent by the
WTP to the AC as an acknowledgement of the receipt of an IEEE 802.11 Key
Configuration Request. 

----XXXX----

Saravanan

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap