Subject: [Capwap] PMK Sharing

From: "Saravanan Govindan" <[email-masked]>
Date: Thu, 19 Jan 2006 09:40:22 +0800

Pat,

Issue:

In the case of an AC managing a same PMK across many WTPs, IEEE 802.11
stations cannot distinguish between PMKs that are validly shared and
those that have been compromised (I0 of Issues/Recommendations).

My recommendation:

Include text in the Security Considerations
(draft-ohara-capwap-lwapp-03.txt) Section 15 along the lines;

"The CAPWAP protocol may be used in scenarios in which an AC manages a
PMK across many WTPs. In such scenarios, IEEE 802.11 stations moving
across WTPs cannot distinguish between PMKs that are legitimately shared
and PMKs that have been compromised. 

The CAPWAP WG recognizes this ambiguity and recommends implementers of
the protocol to review the outcome of IEEE 802.11r efforts for
resolution."

Saravanan 

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "T. Charles Clancy" <[email-masked]>
Date: Wed, 18 Jan 2006 22:28:03 -0500 (EST)

> those that have been compromised (I0 of Issues/Recommendations).

It was my impression that the PMK would never be transported from the AC 
to the WTPs.  The AC transports the *PTK* to the WTPs in the add mobile 
message.  Since the 802.11i four-way handshake is re-executed after each 
handoff, a fresh PTK is used in each add mobile message.  So, I still 
don't understand why PMK sharing is something people are concerned about.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap