Subject: Re:RE: [Capwap] lwapp-dtls edits "LWAPP need support "NULL-Authentication" and "NLL-Encryption" feature"

From: zhaoyujin 31390 <[email-masked]>
Date: Sat, 28 Jan 2006 15:25:05 +0500

LWAPP need support "NULL-Authentication" and "NLL-Encryption" feature.

We have discussed many security issues.

But factly many "fit AP"scenarioes may be interior of one company. The company current wired network does not need secruity.

In "5.2.2  AC Descriptor" only defines two type authentication, this will limit user's application and increase user cost. Fit AP should support to get "shared-key" or "Certificate ".
>   Security:  A 8 bit bit mask specifying the security schemes supported
>      by the AC.  The following values are supported (see Section 10):
>
>      1 - X.509 Certificate Based
>
>      2 - Pre-Shared Secret

Can LWAPP add new Security: 3- NULL-Authentication

Best regards
Michael

> Scott G. Kelly writes... [[email-masked]]
> 
> > As for the PSK algorithms, the text currently says plain psk's must
> not be
> > used due to their vulnerability to dictionary attacks.. Some have
> > suggested this is too restrictive, and after thinking it over, I 
> thinkI
> > agree. It seems like allowing plain psk's but adding the standard
> > admonishments regarding weak passphrases and dictionary attacks 
> mightmake
> > sense.
> 
> I don't have any problem with PSK methods, using suitable crypto-
> suites,key lengths, and key entropy.  I would recommend including 
> one of there.
> As you say, the risk is in generating keys from pass-phrases that have
> low entropy and are subject to dictionary attack. 
> 
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/capwap
> 
> Archives: http://lists.frascone.com/pipermail/capwap
> 

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Scott G Kelly <[email-masked]>
Date: Sat, 28 Jan 2006 06:59:30 -0800

zhaoyujin 31390 wrote:
> But factly many "fit AP"scenarioes may be interior of one company.
> The company current wired network does not need secruity.

I assume you mean "fat AP" - if not, please define "fit AP" (maybe it's 
one that works out for the customer :-))

> In "5.2.2  AC Descriptor" only defines two type authentication, this
> will limit user's application and increase user cost. Fit AP should
> support to get "shared-key" or "Certificate ".

These are both defined authentication methods, so I'm missing something. 
Can you re-phrase your request?

>> Security:  A 8 bit bit mask specifying the security schemes
>> supported by the AC.  The following values are supported (see
>> Section 10):
>> 

Do you mean no security, e.g. TLS_NULL_WITH_NULL_NULL?

--Scott

---

From: Charles Clancy <[email-masked]>
Date: Mon, 30 Jan 2006 08:05:38 -0500

> I assume you mean "fat AP" - if not, please define "fit AP" (maybe
 > it's one that works out for the customer :-))

I think "fit" == "thin".

The point of the original post is that security on the wired network is 
unnecessary in many cases.  The whole point of most wireless 
installation is to provide access to the wired network.  Thus if you 
have to run MitM/spoofing attacks against wired devices before you can 
access the wireless ones, then you should be safe due to the apparent 
paradox.  That is, if you have access to the wired network already, why 
attack the wireless one?

Of course, being the security guy it's my job to strongly disagree. 
Well, I guess it all depends on your threat model.  I imagine the 
so-called "NULL Authentication" would facilitate WTP configuration, but 
a manufacturer generated cert isn't that much harder, and gives you more 
security.

If DTLS were used, then using the NULL ciphersuite would be a good way 
to tackle this problem (if there even really is a problem...)

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

---

From: Charles Clancy <[email-masked]>
Date: Mon, 30 Jan 2006 08:05:47 -0500

I think "fit" == "thin".