Subject: RE: [Capwap] Comments on draft-ietf-capwap-arch-03.txt

From: "Pat R. Calhoun" <[email-masked]>
Date: Fri, 9 Jul 2004 10:18:45 -0700

I think my question was whether a station can become a mesh node - or whether trusted nodes are only used in the mesh network. If so, then hop-by-hop encryption would not be sufficient, right?
 
PatC

________________________________

From: Matt Holdrege [mailto:[email-masked]]
Sent: Fri 7/9/2004 9:05 AM
To: [email-masked]; Pat R. Calhoun
Subject: Re: [Capwap] Comments on draft-ietf-capwap-arch-03.txt

At 08:07 PM 7/8/2004, Pat R. Calhoun wrote:
> 10. Section 5.1. If stations (or non-trusted equipment) are allowed to become part of the mesh backbone, end to end security is required otherwise users traffic will be compromised.
 
I don't see the problem? We say that mesh nodes must authenticate each other within the same admin domain and data transmission must be secure. We also say every mesh link must be encrypted in order to prevent user traffic from becoming encrypted within the mesh backbone. Is there other language missing from section 5.1 that would cover your problem? 
 
-Matt

---

From: Matt Holdrege <[email-masked]>
Date: Fri, 09 Jul 2004 19:54:24 +0200

Maybe more language is necessary, but I think it is kinda redundant to say 
you don't include stations in backbones. And it may also be redundant to 
say trusted nodes only since we already say you must do mutual 
authentication which should prevent un-trusted nodes, right? But anyhow, 
message to the Editor: Include after the authentication sentence in 5.1 
"Each node that is part of the Mesh must be fully trusted for the mesh to 
be secure".

At 07:18 PM 7/9/2004, Pat R. Calhoun wrote:
>I think my question was whether a station can become a mesh node - or 
>whether trusted nodes are only used in the mesh network. If so, then 
>hop-by-hop encryption would not be sufficient, right?
>
>PatC
>
>
>----------
> > 10. Section 5.1. If stations (or non-trusted equipment) are allowed to 
> become part of the mesh backbone, end to end security is required 
> otherwise users traffic will be compromised.
>
>I don't see the problem? We say that mesh nodes must authenticate each 
>other within the same admin domain and data transmission must be secure. 
>We also say every mesh link must be encrypted in order to prevent user 
>traffic from becoming encrypted within the mesh backbone. Is there other 
>language missing from section 5.1 that would cover your problem?
>
>-Matt
>

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap