Subject: [Capwap] crypto algorithms for DTLS

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Tue, 8 Jul 2008 15:01:44 -0700

Folks,

The issue of using AES-GCM as a cipher-suite for CAPWAP/DTLS
was discussed in the list about a year ago.  (Please refer
to CAPWAP issue 7
(http://www.capwap.org/cgi-bin/roundup.cgi/CAPWAP/issue7)

Due to the use of DTLS, we were stuck with TLS ciphersuites.  
To use GCM we would require a TLS GCM ciphersuite.  We discussed this
at an ad-hoc meeting, and decided to defer this feature, as GCM was not
a TLS ciphersuite, and there was no document to reference.

However, since that time, use of AES-GCM has been approved in the
TLS working group, and we have an approved draft 
https://datatracker.ietf.org/idtracker/draft-ietf-tls-rsa-aes-gcm/

As noted in the original email, there is a lot of momentum
behind this crypto algorithm, and it results in significant
improvements in throughput in either HW or SW implementations.

Could we address this issue in the current spec and make
AES-GCM an ciphersuite that can be used with CAPWAP/DTLS ?

Thanks,
Abhijit

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Scott Kelly" <[email-masked]>
Date: Tue, 8 Jul 2008 15:41:51 -0700

Hi Abhijit,
 
> AES-GCM an ciphersuite that can be used with CAPWAP/DTLS ?

I have no objections to adding support for AES-GCM as a MAY. The
original proposal suggested making it mandatory to implement, but given
the current lack of support in commodity crypto HW, I don't think this
would be appropriate at this time.

--Scott

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 8 Jul 2008 15:56:59 -0700

CAPWAP Chairs,

I am done with the edits, and ready to submit the spec for the WG Last
Call. This is a new feature, and we had agreed to defer to the next
version of the protocol. However, the IETF has completed the long pole,
and the change, as a MAY, is fairly minor. What would you recommend?

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]] 
Sent: Tuesday, July 08, 2008 3:42 PM
To: Abhijit Choudhury (achoudhu)
Cc: capwap
Subject: Re: [Capwap] crypto algorithms for DTLS

Hi Abhijit,
 
> 
> Folks,
> 
> The issue of using AES-GCM as a cipher-suite for CAPWAP/DTLS was 
> discussed in the list about a year ago.  (Please refer to CAPWAP issue

> 7
> at an ad-hoc meeting, and decided to defer this feature, as GCM was 
> not a TLS ciphersuite, and there was no document to reference.
> 
> However, since that time, use of AES-GCM has been approved in the TLS 
> working group, and we have an approved draft 
> As noted in the original email, there is a lot of momentum behind this

> crypto algorithm, and it results in significant improvements in 
> throughput in either HW or SW implementations.
> 
> Could we address this issue in the current spec and make AES-GCM an 
> ciphersuite that can be used with CAPWAP/DTLS ?

--Scott

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 8 Jul 2008 16:05:31 -0700

Oh, and just to make sure, if we were to go ahead with this, the
following cipher suites would be added:

TLS_RSA_WITH_AES_128_GCM_SHA256 
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 

Right?

PatC 

-----Original Message-----
From: Pat Calhoun (pacalhou) 
Sent: Tuesday, July 08, 2008 3:57 PM
To: Scott Kelly; Abhijit Choudhury (achoudhu)
Cc: capwap
Subject: Re: [Capwap] crypto algorithms for DTLS

CAPWAP Chairs,

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]]
Sent: Tuesday, July 08, 2008 3:42 PM
To: Abhijit Choudhury (achoudhu)
Cc: capwap
Subject: Re: [Capwap] crypto algorithms for DTLS

Hi Abhijit,

--Scott

---

From: <[email-masked]>
Date: Tue, 8 Jul 2008 18:17:28 -0500

Hi All,

Are there any objections in the WG to adding the following cipher
suites:
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_DH_RSA_WITH_AES_256_GCM_SHA384  to the base spec as a MAY?   

If not, based on the list discussion and approved draft status of
draft-ietf-tls-rsa-aes-gcm-03.txt, I support including these cipher
suites as a MAY in the next(last) WGLC.  

Best Regards,
Dorothy

> From: ext Pat Calhoun (pacalhou) [mailto:[email-masked]] 
> Sent: Tuesday, July 08, 2008 4:06 PM
> Oh, and just to make sure, if we were to go ahead with this, 
> the following cipher suites would be added:
> 
> I am done with the edits, and ready to submit the spec for 
> the WG Last Call. This is a new feature, and we had agreed to 
> defer to the next version of the protocol. However, the IETF 
> has completed the long pole, and the change, as a MAY, is 
> fairly minor. What would you recommend?
> 
> PatC 
> 
> behind this
> I have no objections to adding support for AES-GCM as a MAY. 
> The original proposal suggested making it mandatory to 
> implement, but given the current lack of support in commodity 
> crypto HW, I don't think this would be appropriate at this time.
> 
> --Scott
> 
>

---

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Wed, 9 Jul 2008 11:00:28 -0700

I'm okay with adding AES-GCM support as a MAY.
However, I'd suggest we add the following ciphers:

		TLS_RSA_WITH_AES_128_GCM_SHA256
		TLS_RSA_WITH_AES_256_GCM_SHA384

		TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
		TLS_DHE_RSA_WITH_AES_256_GCM_SHA384  

Also, in the current spec, shouldn't we be specifying
DHE instead of DH in the cipher suite recommendations.

Scott, Charles, Joe: any thoughts on this ?
  
Thanks,
Abhijit

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, July 08, 2008 4:17 PM
To: Pat Calhoun (pacalhou); [email-masked]; Abhijit Choudhury
(achoudhu)
Cc: [email-masked]
Subject: RE: [Capwap] crypto algorithms for DTLS

Hi All,

Best Regards,
Dorothy

> version of the protocol. However, the IETF has completed the long 
> pole, and the change, as a MAY, is fairly minor. What would you 
> recommend?
> 
> PatC
> 
> The original proposal suggested making it mandatory to implement, but 
> given the current lack of support in commodity crypto HW, I don't 
> think this would be appropriate at this time.
> 
> --Scott
> 
>

---

From: "Scott Kelly" <[email-masked]>
Date: Wed, 9 Jul 2008 11:07:55 -0700

Hi Abhijit,

Yes, it should be DHE - this has come up several times now, but keeps
falling through the cracks somehow.

--Scott

> From: Abhijit Choudhury (achoudhu) [mailto:[email-masked]] 
> Sent: Wednesday, July 09, 2008 11:00 AM
> To: [email-masked]; Pat Calhoun (pacalhou); Scott 
> Kelly; Joseph Salowey (jsalowey)
> Cc: [email-masked]
> the WG Last
> AES-GCM an 
> implement, but

---

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Wed, 9 Jul 2008 11:23:00 -0700

Hi Dorothy, 

Please note that AES-GCM requires TLS1.2 which is 
currently in AUTH48 state in the RFC-editors 
queue and should be published shortly.  
DTLS1.2, which is based on TLS1.2, is working group item
and will most likely make it to last call after next IETF.

I would suggest we reference TLS1.2 and add the
AES-GCM ciphersuites as MAY.

Also, in order to ensure that CAPWAP track DTLS better,
we should change the text in section 2.4.4.1 
from

"Note that only block ciphers are currently recommended for use with
DTLS.  To understand the reasoning behind this, see [DTLS-DESIGN]."

To

"CAPWAP implementations only use cipher suites that are recommended 
for use with DTLS.  Note that certain stream ciphers, such as RC4, 
that cannot be randomly accessed may not be used with DTLS."

Thoughts ?

Abhijit

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, July 08, 2008 4:17 PM
To: Pat Calhoun (pacalhou); [email-masked]; Abhijit Choudhury
(achoudhu)
Cc: [email-masked]

Hi All,

Best Regards,
Dorothy

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 9 Jul 2008 11:09:20 -0700

> From: Abhijit Choudhury (achoudhu) 
> To: [email-masked]; Pat Calhoun (pacalhou); 
> [email-masked]; Joseph Salowey (jsalowey)
> Cc: [email-masked]
> Also, in the current spec, shouldn't we be specifying DHE 
> instead of DH in the cipher suite recommendations.
> 
[Joe] The DH cipher suites are for certificates containing static
Diffie-Hellman keys which are not commonly used.  I think you probably
mean to specify DHE which are the ephemeral Diffie-hellman variants that
are more commonly used and provide forward secrecy.  

The GCM cipher suites are based on TLS 1.2 which is currently in AUTH48
state in the RFC-editors queue and should be published shortly.  

> To: Pat Calhoun (pacalhou); [email-masked]; Abhijit 
> Choudhury (achoudhu)
> Cc: [email-masked]
> If not, based on the list discussion and approved draft 
> status of draft-ietf-tls-rsa-aes-gcm-03.txt, I support 
> including these cipher suites as a MAY in the next(last) WGLC.  
> 
> Best Regards,
> Dorothy
> 
>

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Wed, 9 Jul 2008 12:28:52 -0700

Ah, so this is a much larger change than simply adding two ciphers as
MAY. I don't have visibility into TLS1.2 and DTLS1.2, and therefore have
no idea whether this would break anything.

Scott and CAPWAP chairs, do we go ahead with this change? Given it has
been through IETF and IESG review, I suspect it would make sense to use
the latest version.

PatC 

-----Original Message-----
From: Abhijit Choudhury (achoudhu) 
Sent: Wednesday, July 09, 2008 11:23 AM
To: [email-masked]; Pat Calhoun (pacalhou);

Hi Dorothy, 

Please note that AES-GCM requires TLS1.2 which is currently in AUTH48
state in the RFC-editors queue and should be published shortly.  
DTLS1.2, which is based on TLS1.2, is working group item and will most
likely make it to last call after next IETF.

I would suggest we reference TLS1.2 and add the AES-GCM ciphersuites as
MAY.

Also, in order to ensure that CAPWAP track DTLS better, we should change
the text in section 2.4.4.1 from

To

"CAPWAP implementations only use cipher suites that are recommended for
use with DTLS.  Note that certain stream ciphers, such as RC4, that
cannot be randomly accessed may not be used with DTLS."

Thoughts ?

Abhijit

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, July 08, 2008 4:17 PM
To: Pat Calhoun (pacalhou); [email-masked]; Abhijit Choudhury
(achoudhu)
Cc: [email-masked]

Hi All,

Best Regards,
Dorothy

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Wed, 9 Jul 2008 14:07:28 -0700

Trying again - the e-mail somehow never made it to the capwap list.

PatC 

-----Original Message-----
From: Pat Calhoun (pacalhou) 
Sent: Wednesday, July 09, 2008 12:29 PM
To: Abhijit Choudhury (achoudhu); [email-masked]';
[email-masked]'; Joseph Salowey (jsalowey)
Cc: [email-masked]'
Subject: RE: [Capwap] crypto algorithms for DTLS
Importance: High

PatC 

-----Original Message-----
From: Abhijit Choudhury (achoudhu)
Sent: Wednesday, July 09, 2008 11:23 AM
To: [email-masked]; Pat Calhoun (pacalhou);

Hi Dorothy, 

To

Thoughts ?

Abhijit

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, July 08, 2008 4:17 PM
To: Pat Calhoun (pacalhou); [email-masked]; Abhijit Choudhury
(achoudhu)
Cc: [email-masked]

Hi All,

Best Regards,
Dorothy

---

From: "Scott Kelly" <[email-masked]>
Date: Wed, 9 Jul 2008 14:19:49 -0700

> been through IETF and IESG review, I suspect it would make 

Referencing DTLS algs which are not yet standardized seems a little bit
risky, and also would require a bit of wink wink nudge nudge in the
process. Kind of calls the credibility of this whole exercise into
question.

How bad would it be to wait? It would simply require spinning out a new
brief 3-5 page doc updating to DTLS1.2. This wouldn't prevent anyone who
wants to from implementing the algorithms.

Is there any compelling reason to ram this through rather than waiting
for DTLS1.2 to be published?

--Scott

---

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Wed, 9 Jul 2008 14:49:31 -0700

Hi Scott,

My understanding is that DTLS1.2 will use the ciphers
specified in TLS1.2, which has already been approved.
The DTLS1.2 spec will not have new ciphers, but will
possibly have details on how to use these ciphers in DTLS.
Please correct me if I'm wrong here.

So, we should be okay adding these approved TLS ciphers
to the OPTIONAL list, although it's true that they will not
be used until DTLS1.2 is finalized. But the list is only
OPTIONAL and there are other optional ciphers as well.
If we take this path, we don't have to touch this spec later
to add these ciphers.

If we go the other route, how do we see it being done ?
Will we need a draft to specify just the deltas in using DTLS1.2 
for CAPWAP ?  The concern I have is that it's not clear if
the CAPWAP WG will be active at that point to take up this
new work item.

Thoughts ?

Abhijit

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]] 
Sent: Wednesday, July 09, 2008 2:20 PM
To: Pat Calhoun (pacalhou); Abhijit Choudhury (achoudhu);
[email-masked]; Joseph Salowey (jsalowey)
Cc: [email-masked]
Subject: RE: [Capwap] crypto algorithms for DTLS

Pat Calhoun wrote:
> MAY. I don't have visibility into TLS1.2 and DTLS1.2, and therefore 
> have no idea whether this would break anything.
> 

> been through IETF and IESG review, I suspect it would make sense to 
> use the latest version.

--Scott

---

From: "Scott Kelly" <[email-masked]>
Date: Thu, 10 Jul 2008 09:13:55 -0700

Hi Abhijit, 

> If we take this path, we don't have to touch this spec later

I think there's a flaw in this logic. The currently optional ciphers are
supported in DTLS1.0 -- you are asking to add ciphers which are not
supported in DTLS1.0, meaning a compliant CAPWAP implementation (i.e.
one implementing DTLS1.0) will not be able to interoperate with one
using these ciphers.

> the CAPWAP WG will be active at that point to take up this

Yes, I think a new, brief document specifying the deltas is exactly what
will be required. I also think speculation on the potential
(non)existence of the capwap working group should not be the driver
here. It isn't very relevant one way or the other. For example, we've
published a number of ammendments to IPsec since the wg dissolved, and
the ADs willingly sponsored/shepherded these documents through. If for
some odd reason (despite the fact that we've just started mib work) the
capwap wg dissolves, this should present no impediment to publishing an
updated DTLS binding document.

It's rarely a good idea to rush such initiatives. 

--Scott

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 10 Jul 2008 09:27:38 -0700

Ok, given this debate, and being short on time, I will submit the
documents without the GCM ciphers, and therefore will not be making
changes from TLS/DTLS1.1 to TLS/DTLS1.2. We can deal with this in a
separate document. I would recommend adding the following sentence after
the list of supported ciphers in both the certificate and pre-shared
key:

   Additional ciphers MAY be defined in follow on CAPWAP specifications.

Ok?

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]] 
Sent: Thursday, July 10, 2008 9:14 AM
To: Abhijit Choudhury (achoudhu); Pat Calhoun (pacalhou);

Hi Abhijit, 

> My understanding is that DTLS1.2 will use the ciphers specified in 
> TLS1.2, which has already been approved.
> The DTLS1.2 spec will not have new ciphers, but will possibly have 
> details on how to use these ciphers in DTLS.
> So, we should be okay adding these approved TLS ciphers to the 
> OPTIONAL list, although it's true that they will not be used until 
> DTLS1.2 is finalized. But the list is only OPTIONAL and there are 
> other optional ciphers as well.
> If we take this path, we don't have to touch this spec later to add 
> these ciphers.

> Will we need a draft to specify just the deltas in using DTLS1.2 for 
> CAPWAP ?  The concern I have is that it's not clear if the CAPWAP WG 
> will be active at that point to take up this new work item.
> 
> Thoughts ?

--Scott

---

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Thu, 10 Jul 2008 09:42:58 -0700

Hi Scott,

Please see in-line.

Thanks,
Abhijit

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]] 
Sent: Thursday, July 10, 2008 9:14 AM
To: Abhijit Choudhury (achoudhu); Pat Calhoun (pacalhou);

Hi Abhijit, 

[Abhijit]  I don't buy this argument.  Let's say we go down the route of
creating
           a separate document in the future to add the DTLS1.2 ciphers.
What changes ?
	     A compliant DTLS1.0 implementation will  be able to
interoperate
           with a compliant DTLS1.2 implementation using the DTLS1.0
ciphers,  
           but not with the new AEAD ciphers.  So, the negotiation of
the ciphersuite
           pretty much decides the interoperability.

--Scott

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 10 Jul 2008 09:50:22 -0700

I changed ciphers from DH to DHE.

PatC

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]] 
Sent: Wednesday, July 09, 2008 11:08 AM
To: Abhijit Choudhury (achoudhu); [email-masked]; Pat Calhoun
(pacalhou); Joseph Salowey (jsalowey)
Cc: [email-masked]
Subject: RE: [Capwap] crypto algorithms for DTLS

Hi Abhijit,

--Scott

> To: [email-masked]; Pat Calhoun (pacalhou); Scott Kelly; 
> Joseph Salowey (jsalowey)
> Cc: [email-masked]
> Also, in the current spec, shouldn't we be specifying DHE instead of 
> DH in the cipher suite recommendations.
> 
> Choudhury

---

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Thu, 10 Jul 2008 09:52:22 -0700

Okay. I'm fine with defering this. Let's not delay the current spec.

I'd suggest the following changes:

1. In order to ensure that CAPWAP track DTLS better, we should 
    change the text in section 2.4.4.1 from

"Note that only block ciphers are currently recommended for use with
DTLS.  
To understand the reasoning behind this, see [DTLS-DESIGN]."

To

use with DTLS." 

2. Change the existing ciphers using DH to DHE.

Thanks,
Abhijit

-----Original Message-----
From: Pat Calhoun (pacalhou) 
Sent: Thursday, July 10, 2008 9:28 AM
To: Scott Kelly; Abhijit Choudhury (achoudhu);

Ok?

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]]
Sent: Thursday, July 10, 2008 9:14 AM
To: Abhijit Choudhury (achoudhu); Pat Calhoun (pacalhou);

Hi Abhijit, 

--Scott

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 10 Jul 2008 10:17:34 -0700

Out of curiosity, what is different in your text, other than removing
the reference to a document that, I guess, provides more clarity on why
this statement is made? Is it the explicit removal of block ciphers that
is what's desired here?

PatC 

-----Original Message-----
From: Abhijit Choudhury (achoudhu) 
Sent: Thursday, July 10, 2008 9:52 AM
To: Pat Calhoun (pacalhou); 'Scott Kelly'; [email-masked]';

To

Thanks,
Abhijit

-----Original Message-----
From: Pat Calhoun (pacalhou)
Sent: Thursday, July 10, 2008 9:28 AM
To: Scott Kelly; Abhijit Choudhury (achoudhu);

Ok?

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]]
Sent: Thursday, July 10, 2008 9:14 AM
To: Abhijit Choudhury (achoudhu); Pat Calhoun (pacalhou);

Hi Abhijit, 

--Scott

---

From: "Abhijit Choudhury (achoudhu)" <[email-masked]>
Date: Thu, 10 Jul 2008 11:25:39 -0700

Yes, CAPWAP doesn't need to constrain the ciphers to block ciphers.
The real reason is that CAPWAP tracks DTLS1.0 which tracks TLS1.1, 
which uses block ciphers.
So, it'd be better to say explicitly that we only use ciphers
recommended for DTLS. This way, it'll be easier to upgrade later 
to DTLS1.2, without having to change text in this spec.

We could include the reference... That's fine.

So, how about this:

Replace the text in section 2.4.4.1 from

	"Note that only block ciphers are currently recommended for use
with DTLS.  
	To understand the reasoning behind this, see [DTLS-DESIGN]."

To

	"CAPWAP implementations only use cipher suites that are
recommended for 
       use with DTLS [DTLS-DESIGN]." 

Thanks,
Abhijit

-----Original Message-----
From: Pat Calhoun (pacalhou) 
Sent: Thursday, July 10, 2008 10:18 AM
To: Abhijit Choudhury (achoudhu); 'Scott Kelly';
[email-masked]'; Joseph Salowey (jsalowey)
Cc: [email-masked]'
Subject: RE: [Capwap] crypto algorithms for DTLS

PatC 

-----Original Message-----
From: Abhijit Choudhury (achoudhu)
Sent: Thursday, July 10, 2008 9:52 AM
To: Pat Calhoun (pacalhou); 'Scott Kelly'; [email-masked]';

To

Thanks,
Abhijit

-----Original Message-----
From: Pat Calhoun (pacalhou)
Sent: Thursday, July 10, 2008 9:28 AM
To: Scott Kelly; Abhijit Choudhury (achoudhu);

Ok?

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]]
Sent: Thursday, July 10, 2008 9:14 AM
To: Abhijit Choudhury (achoudhu); Pat Calhoun (pacalhou);

Hi Abhijit, 

--Scott

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 10 Jul 2008 11:29:51 -0700

Scott - Are you OK with this proposal?

PatC 

-----Original Message-----
From: Abhijit Choudhury (achoudhu) 
Sent: Thursday, July 10, 2008 11:26 AM
To: Pat Calhoun (pacalhou); 'Scott Kelly'; [email-masked]';

Yes, CAPWAP doesn't need to constrain the ciphers to block ciphers.
The real reason is that CAPWAP tracks DTLS1.0 which tracks TLS1.1, which
uses block ciphers.
So, it'd be better to say explicitly that we only use ciphers
recommended for DTLS. This way, it'll be easier to upgrade later to
DTLS1.2, without having to change text in this spec.

So, how about this:

To

Thanks,
Abhijit

-----Original Message-----
From: Pat Calhoun (pacalhou)
Sent: Thursday, July 10, 2008 10:18 AM
To: Abhijit Choudhury (achoudhu); 'Scott Kelly';

PatC 

-----Original Message-----
From: Abhijit Choudhury (achoudhu)
Sent: Thursday, July 10, 2008 9:52 AM
To: Pat Calhoun (pacalhou); 'Scott Kelly'; [email-masked]';

To

Thanks,
Abhijit

-----Original Message-----
From: Pat Calhoun (pacalhou)
Sent: Thursday, July 10, 2008 9:28 AM
To: Scott Kelly; Abhijit Choudhury (achoudhu);

Ok?

PatC 

-----Original Message-----
From: Scott Kelly [mailto:[email-masked]]
Sent: Thursday, July 10, 2008 9:14 AM
To: Abhijit Choudhury (achoudhu); Pat Calhoun (pacalhou);

Hi Abhijit, 

--Scott

---

From: "Scott Kelly" <[email-masked]>
Date: Thu, 10 Jul 2008 11:45:19 -0700

I think this is probably a safe statement.

> From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
> Sent: Thursday, July 10, 2008 11:30 AM
> To: Abhijit Choudhury (achoudhu); Scott Kelly;

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 10 Jul 2008 17:36:43 -0700

I think it would be best to reference the DTLS specification (RFC4347)
for recommendations on cipher suites for use with DTLS.  

Cheers,

Joe 

> Sent: Thursday, July 10, 2008 11:45 AM
> > To: Pat Calhoun (pacalhou); 'Scott Kelly'; 
> recommended 
> > for
> > the reference to a document that, I guess, provides more clarity on 
> > why this statement is made? Is it the explicit removal of block 
> > ciphers that is what's desired here?
> > 
> > PatC
> > 
> > To: Pat Calhoun (pacalhou); 'Scott Kelly'; 
> > for use with DTLS."
> > separate document. I would recommend adding the following sentence 
> > after the list of supported ciphers in both the certificate and 
> > pre-shared
> > key:
> > 
> possibly have 
> > I think there's a flaw in this logic. The currently 
> optional ciphers 
> > are supported in DTLS1.0 -- you are asking to add ciphers which are 
> > not supported in DTLS1.0, meaning a compliant CAPWAP implementation 
> > (i.e.
> > Yes, I think a new, brief document specifying the deltas is exactly 
> > what will be required. I also think speculation on the potential 
> > capwap wg dissolves, this should present no impediment to 
> publishing 
> > an updated DTLS binding document.
> >

---

From: "Scott Kelly" <[email-masked]>
Date: Fri, 11 Jul 2008 09:27:34 -0700

I agree with Joe. 

> From: Joseph Salowey (jsalowey) [mailto:[email-masked]] 
> Sent: Thursday, July 10, 2008 5:37 PM
> To: Scott Kelly; Pat Calhoun (pacalhou); Abhijit Choudhury 
> (achoudhu); [email-masked]
> Cc: [email-masked]

---

From: Margaret Wasserman <[email-masked]>
Date: Fri, 11 Jul 2008 12:53:48 -0400

Just my personal opinion...

I'd prefer to leave the security stuff as-is in this spec, unless it  
has a blocking technical flaw, because it has already been through  
Security Directorate review and has been reviewed by one (ex-)  
Security AD.

There will always be a next update that we could consider in CAPWAP.   
For instance, there have been several updates to the IEEE specs that  
we have agreed not to consider, because it was necessary to draw a  
line and get this spec out.  I'd prefer to draw the same line for  
these new security specs, get this document out as-is, and consider  
any updates for a later version.

Margaret

On Jul 10, 2008, at 12:13 PM, Scott Kelly wrote:

> what
> publishing an