Subject: [Capwap] Proposal - Issue43 IEEE 802.11i Considerations

From: "Saravanan Govindan" <[email-masked]>
Date: Wed, 8 Feb 2006 14:14:57 +0800

All,

Regarding Issue 43 dealing with cases of IEEE 802.11i authenticator and
cryptography functions being handled separately by the AC and WTP, the
following is proposed text based on LWAPP-03. 

Note: Include 2 additional message types in (Section 4.2.1.1 Message
Type)

Description                                  Value

Key Configuration                         41

Key Configuration Response         42

-----------------------XXXX------------------------------------------

Note: Include additional sub-sections in (Section 7 WTP Configuration
Management)

Section 7.8 WTP Key Configuration

The Key Configuration message is used in WTP designs in which IEEE
802.11i authenticator functions are performed by the AC and IEEE 802.11i
cryptographic functions (encryption/decryption) are performed by the
WTPs. 

Section 7.8.1 4-way Handshake

For the 4-way handshake, the AC does not calculate the KeyMIC for
Message-3 as it is unaware of the prevailing KeyRSC sequence counter. In
this case, Message-1, Message-2 and Message-4 of the 4-way handshake are
transported within CAPWAP data packets between AC and WTP. Message-3 is
sent within the Key Configuration message to the WTP. 

The payload of the Key Configuration message is Message-3 of the 4-way
handshake. The payload of Key Configuration is listed below:

GTK-Flag

Encryption-Data 

EAPoL-Frame 

GTK-Flag: Determines type of KeyMIC calculation

                0 - New GTK, KeyMIC is calculated with KeyRSC = 0

                1 - Existing GTK, KeyMIC is calculated with prevailing
KeyRSC value

Encryption-Data: PTK and/or GTK

EAPoL-Frame: Message-3 of 4-way handshake with unassigned fields

Upon receipt of the Key Configuration message from AC, the WTP performs
the following operations:

         i.            Assigns the corresponding value to the KeyRSC
field of the EAPoL-Frame 

       ii.            Calculates KeyMIC with Encrytion-Data and KeyRSC

      iii.            Updates Message-3 of 4-way handshake

      iv.            Continues regular 4-way handshake with wireless
terminals

Section 7.8.2 Group Key Handshake

For the group key handshake, the AC does not calculate the KeyMIC for
Message-1 as it is unaware of the prevailing KeyRSC sequence counter. In
such case, Message-2 of the group key handshake is transported within
CAPWAP data packets between AC and WTP. Message-1 is sent within the Key
Configuration message to the WTP. 

The payload of the Key Configuration message is Message-1 of the group
key handshake. The format of Key Configuration:

GTK-Flag

Encryption-Data 

EAPoL-Frame 

GTK-Flag: Determines type of KeyMIC calculation

                0 - New GTK, KeyMIC is calculated with KeyRSC = 0

                1 - Existing GTK, KeyMIC is calculated with prevailing
KeyRSC value

Encryption-Data: GTK

EAPoL-Frame: Message-1 of group key handshake with unassigned fields

Upon receipt of the Key Configuration message from AC, the WTP performs
the following operations:

         i.            Assigns the corresponding value to the KeyRSC
field of the EAPoL-Frame 

       ii.            Calculates KeyMIC with Encrytion-Data and KeyRSC

      iii.            Updates Message-1 of group key handshake

      iv.            Continues regular group handshake with wireless
terminals

----------------------XXXX---------------------------------------

I look forward to comments.

Saravanan

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap