Subject: RE: [Capwap] The WG Last call on Taxonomy has ended.

From: "Mani, Mahalingam (Mahalingam)" <[email-masked]>
Date: Wed, 22 Sep 2004 08:41:26 -0600

Matt,

Posting to the list the *changes* exactly as you *had* suggested.

<draft-05>
     "Similar security concerns for client data security as described in
   Section 4.8.1 also apply to the Distributed Mesh Architecture.
   Additionally, one important security consideration for the mesh
   networks is that the mesh nodes must authenticate each other within
   the same administrative domain, and data transmission among
   neighboring nodes must be secured.  Each node that is part of the
   mesh must be fully trusted for the mesh to be secure.  It is often
   recommended that all communication between mesh nodes be secured by
   some mechanism of confidentiality, integrity and replay protection,
   since they may carry user traffic that is not.  For this reason, the
   operator should always encrypt and protect mesh links, in order to 
   fully secure the network."

</draft-05>

<matt-change-proposed>

"Similar security concerns for client data security as described in
Section

4.8.1 also apply to the Distributed Mesh Architecture. Additionally, one
important security consideration for the mesh networks is that the mesh
nodes must authenticate each other within the same administrative
domain. 

Also to protect user and management data that may not be secured at
layer 3, data transmission among neighboring nodes should be secured by
a layer 2 mechanism of confidentiality, integrity and replay protection.
IEEE 802.11i is recommended."

</matt-change-proposed>

My objection to the change is that we are not chartered to recommend
security mechanisms over-the-air in the MAC-realm between mesh nodes.

Discussion of this component of threat to meshnetwork is not in scope
for CAPWAP.

Regards,

-mani

  _____  

From: Matt Holdrege [mailto:[email-masked]] 
Sent: Tuesday, September 21, 2004 1:31 PM
To: Mani, Mahalingam (Mahalingam); [email-masked]
Cc: Dorothy Gellert (E-mail)
Subject: Re: [Capwap] The WG Last call on Taxonomy has ended.

At 09:58 PM 9/21/2004, Mani, Mahalingam (Mahalingam) wrote:

The last call on taxonomy draft
(http://www.ietf.org/internet-drafts/draft-ietf-capwap-arch-05.txt
<http://www.ietf.org/internet-drafts/draft-ietf-capwap-arch-05.txt> )
has closed last week (9/16/04). We did not receive/hear
any comments on this call. We will be forqrding this for IESG to
consider it to progress this as an informational RFC.
 
[The exception was the concern raised regarding wordings in security
considerations in mesh-networks. The resolution at this time:
Mesh-networking being a work-in-progress in IEEE - proposing /
recommending solutions can be deferred until the threat model is better
understood].

I was the one who raised the concern as our original words that the
design team developed were changed in this final draft. Mani told me we
could revise them as we get comments from the IESG. I'm fine with that.
However I don't agree with the words above that we don't understand the
threat model and we need to wait for IEEE work-in-progress. We
understood it fine when we put the security section together. We should
complete our security section properly before it becomes an RFC.

-Matt