Subject: [Capwap] Issue 160: Use of Replay Protection

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Mon, 28 Jul 2008 12:48:41 -0700

Here is Pasi's comment:

   Replay protection is an optional feature in RFC 4347. Should this
document say 
   something about it? (e.g. MUST use?)

Given the nature of the question, I would like to defer to Scott or
Charles. I recall us going back and forth on this, and would like their
guidance before we propose a change.

PatC
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Charles Clancy <[email-masked]>
Date: Mon, 28 Jul 2008 21:09:06 -0400

Saying that DTLS replay detection MUST be used is okay with me.  Section 
4.5.3 has text that assumes DTLS replay detection is being used.

--
t. charles clancy, ph.d.                 eng.umd.edu/~tcc
electrical & computer engineering, university of maryland

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 29 Jul 2008 08:52:27 -0700

Charles, could you propose the best way to include this in the draft?

PatC 

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Monday, July 28, 2008 6:09 PM
To: Pat Calhoun (pacalhou)
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Capwap] Issue 160: Use of Replay Protection

Pat Calhoun (pacalhou) wrote:
> Charles. I recall us going back and forth on this, and would like 
> their guidance before we propose a change.
> 
> PatC

---

From: Charles Clancy <[email-masked]>
Date: Tue, 29 Jul 2008 13:11:11 -0400

Pat,

A new paragraph to the end of section 2.4.1:

The DTLS implementation used by CAPWAP MUST use replay detection, per 
Section 3.3 of <xref target="RFC4347"/>.  Since the CAPWAP protocol 
handles retransmissions by re-encrypting lost frames, any duplicate DTLS 
frames are either unintentional or malicious, and should be silently 
discarded.