Subject: [Capwap] Issue 223: Provide reasoning for MAC Address in CN Field

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 10 Oct 2008 07:23:20 -0700

During the IESG review, there were a few comments raised about the use
of the 
MAC Address in the X.509 certificate Common Name (CN) field. There were
two 
agreements made during this time, the first was to provide references to
other 
standards that were making use of this convention (e.g., Packet Cable,
WiMAX, 
DOCSIS). The second was to include some text about the reasoning for
using the 
MAC Address in the CN Field vs. some other (more appropriate)
identifier.

After a few back and forths, we agreed on the following text:

<proposed text>
2.4.4.3.  Certificate Usage
[...]
   CAPWAP implementations MUST support certificates where the common
   name (CN) for both the WTP and AC is the MAC address of that device.
   The MAC address MUST be encoded in the PrintableString format, using
   the well recognized MAC address format of 01:23:45:67:89:ab.  The CN
   field MAY contain either of the EUI-48 [EUI-48] or EUI-64 [EUI-64]
   MAC Address formats.  This seemingly unconventional use of the CN
   field is consistent with other standards that rely on device
   certificates that are provisioned during the manufacturing process,
   such as Packet Cable [PacketCable], Cable Labs [CableLabs] and WiMAX
   [WiMAX].  See Section 12.8 for more information on the use of the MAC
   Address in the CN field.

12.8.  Use of MAC Address in CN Field

   The CAPWAP protocol is an evolution of an existing protocol
   [I-D.ohara-capwap-lwapp] which is implemented on a large number of
   already deployed ACs and WTPs.  Everyone of these devices have an
   existing X.509 certificate, which is provisioned at manufacturing
   time.  These X.509 certificates use the device's MAC Address in the
   Common Name (CN) field.  It is well understood that encoding the MAC
   Address in the CN field is less than optimal, and using the
   SubjectAltName field would be preferable.  However, at the time of
   publication, there is no URN specification that allows for the MAC
   Address to be used in the SubjectAltName field.  As such a
   specification is published by the IETG, future versions of the CAPWAP
   protocol MAY require support for the new URN scheme.

17.2.  Informational References
[...]

   [PacketCable]
              "PacketCable Security Specification PKT-SP-SEC-I12-
              050812", August 2005, <PacketCable>.

   [CableLabs]
              "OpenCable System Security Specification OC-SP-SEC-I07-
              061031", October 2006, <CableLabs>.

   [WiMAX]    "WiMAX Forum X.509 Device Certificate Profile Approved
              Specification V1.0.1", April 2008, <WiMAX>. 
</proposed text>
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: <[email-masked]>
Date: Fri, 10 Oct 2008 14:43:44 -0500

Hi All,

Sorry I was not part of IESG review so if this repeats points raised
there apologies...

The uses of MAC as CN (or in general as an ID) were fine when the
devices never moved and had no need for privacy concerns, and had no
need to interwork with other networks because they were single mode
access devices. The use of CN in WiMAX is primarily stemming from the
early model of WiMAX as extension of cable, before WiMAX mobility.

In mobile, multi access devices, the identifier(s) need to be treatable
separately from the address(es) at all layers.

Would we accept a slight change to the proposed text to emphasize the
distinctions here:

<proposed text>
2.4.4.3
[...]
   This seemingly unconventional use of the CN
   field is consistent with other standards that rely on device
   certificates that are provisioned during the manufacturing process,
   such as Packet Cable [PacketCable], Cable Labs [CableLabs] and WiMAX
   [WiMAX].
<revised proposed text>
2.4.4.3
[...]
   This use of the MAC address as an identifier
   is consistent with other standards for wired or fixed wireless
network devices, that rely on device
   certificates that are provisioned during the manufacturing process,
   such as Packet Cable [PacketCable], Cable Labs [CableLabs] and WiMAX
   [WiMAX]. 

If changes along these lines would be acceptable, some similar change to
12.8 would be proposed.

Best Regards,
Michael

-----Original Message-----
From: ext Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: 10 October, 2008 07:23
To: [email-masked]
Subject: [Capwap] Issue 223: Provide reasoning for MAC Address in CN
Field

During the IESG review, there were a few comments raised about the use
of the MAC Address in the X.509 certificate Common Name (CN) field.
There were two agreements made during this time, the first was to
provide references to other standards that were making use of this
convention (e.g., Packet Cable, WiMAX, DOCSIS). The second was to
include some text about the reasoning for using the MAC Address in the
CN Field vs. some other (more appropriate) identifier.

<proposed text>

   [PacketCable]

   [CableLabs]