Subject: [Capwap] FW: DISCUSS and COMMENT: draft-ietf-capwap-objectives

From: "Mani, Mahalingam (Mani)" <[email-masked]>
Date: Thu, 16 Feb 2006 08:41:01 -0700

More comments on objectives...

-mani
======

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Thursday, February 16, 2006 7:20 AM
To: [email-masked]
Cc: Mani, Mahalingam (Mani); [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]
Subject: DISCUSS and COMMENT: draft-ietf-capwap-objectives 

Discuss:
Section 5.1.8 implies that an authenticated key exchange is optional.
I think that BCP 107 will require an authenticated key exchange for
this protocol.

In the following text, please describe what security services are
meant; probable services include integrity and confidentiality.
>Once WTPs and WLAN controller have been mutually authenticated,
>   information exchanges between them must be secured against various
>   security threats.

Comment:
The introduction to section 5 implies that operator requirements are
valued less than non-objectives.  I don't think that is the message the
IETF wants to send to the operator community.

>   The priorities are;

>   i.  Mandatory and Accepted Objectives
>   ii.  Desirable Objectives
>   iii.  Non-Objectives
>   iv.  Operator Requirements

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "T. Charles Clancy" <[email-masked]>
Date: Thu, 16 Feb 2006 11:39:34 -0500 (EST)

> Section 5.1.8 implies that an authenticated key exchange is optional. I 
> think that BCP 107 will require an authenticated key exchange for this 
> protocol.

We require mutual authentication, but don't necessarily specify the use of 
an AKE.  BCP 107 describes the process of "Automated Key Management", 
which may or may not be required, depending on exactly how the CAPWAP 
protocol operates.  Certainly LWAPP (sans DTLS) would require automated 
key management, because it uses AES-CCM.

Does "Automated Key Management" == "Authenticated Key Exchange"?  I can't 
think of a reasonable way to do AKM without an AKE.

We could essentially restate BCP 107 in section 5.1.8.  Suggested text:

"If the CAPWAP protocol meets the criteria to require automated key 
management per BCP 107, then mutual authentication MUST be accomplished 
via an authenticated key exchange."

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap