Subject: [Capwap] IESG Review

From: "Saravanan Govindan" <[email-masked]>
Date: Mon, 20 Feb 2006 14:41:29 +0800

Hi All,

This is a list of comments from the IESG and suggested responses.
Feedback would be appreciated.

Saravanan

 

Brian Carpenter's Review:

1. Section: 5.1.8 CAPWAP Protocol Security, Protocol Requirement

Comment: "Does that [secured] mean encrypted or integrity-protected?"

Original text: "The CAPWAP protocol MUST support mutual authentication
of WTPs and the centralized controller.  It must also ensure that
information exchanges between them are secured."

Suggestion: From Charles Clancy - "The CAPWAP protocol MUST support
mutual authentication of WTPs and the centralized controller. It also
MUST ensure that information exchanges are integrity protected, and
SHOULD ensure confidentiality through encryption."

--XX--

2. Section: 5.1.9 System-wide Security, Protocol Requirement

Comment: "Strange phrasing" of requirement

Original text: "The design of the CAPWAP protocol MUST NOT allow for any
compromises to the WLAN system by external entities."

Clarification: From Mani - "the intent was to emphasize that the
protocol MUST not introduce additional threats weakening the security of
WLAN system. CAPWAP protocol by itself is not intended to and cannot
protect against all compromises to the WLAN system which is broader than
the scope of the protocol."

--XX-

3. Section: 5.1.12 Protocol Specifications

Comment: "Since this is a basic requirement of all IETF standards, why
is it listed?"

Original text: "Any WTP or WLAN controller vendor or any person MUST be
able to implement the CAPWAP protocol from the specification itself and
by that it is required that all such implementations do interoperate."
 
Clarification: From Saravanan - "This objective arose during discussions
on the scope of the CAPWAP protocol in managing WLAN systems. The intent
was to highlight the 'completeness' of protocol in terms of achieving
its interoperability goals."
--XX-
 
4. Section: 5.2 Desirable Objectives
 
Comment: "Why aren't the items in this section listed as SHOULD instead
of MUST?"
 
Clarification: From Saravanan - "The Desirable Objectives as a category
can be listed as 'SHOULD'. However, the individual objectives that make
up the category are still 'MUST', because they represent mandatory
operations for the protocol - provided that the protocol chooses to
realize a Desirable Objective."
--XX-

Sam Hartman's Review
 
5. Section: 5.1.8 CAPWAP Protocol Security
 
Comment: "Section 5.1.8 implies that an authenticated key exchange is
optional. I think that BCP 107 will require an authenticated key
exchange for this protocol."
 
Suggestion: From Charles Clancy [To be inserted as last paragraph of
Description] - "If the CAPWAP protocol meets the criteria to require
automated key management per BCP 107, then mutual authentication MUST be
accomplished via an authenticated key exchange."
 
[Reference to BCP 107 to be included.]
--XX-
 
6. Section: 5.1.8 CAPWAP Protocol Security, Description, Paragraph 5
 
Comment: In the following text, please describe what security services
are meant; probable services include integrity and confidentiality.
 
> Once WTPs and WLAN controller have been mutually authenticated,
information exchanges between them
> must be secured against various security threats.
 
Suggestion: From Saravanan - "Once WTPs and WLAN controller have been
mutually authenticated, information exchanges between them must be
secured against various security threats by providing confidentiality
and integrity protection."
--XX-
 
7. Section: 5 Objectives, Introduction
 
Comment: "The introduction to section 5 implies that operator
requirements are valued less than non-objectives.  I don't think that is
the message the IETF wants to send to the operator community."
 
Suggestion: From Saravanan, Reorganize introduction paragraph. 
 
"The objectives described in this document have been prioritized based
on their immediate significance in the development and evaluation of a
control and provisioning protocol for large-scale WLAN deployments.
 
The priorities are;
 
i.  Mandatory and Accepted Objectives
ii.  Desirable Objectives
iii.  Non-Objectives
 
The priorities have been assigned to individual objectives in accordance
with working group discussions.
 
Furthermore, a distinct category of objectives is provided based on
requirements gathered from network service operators.  These are
specific need that arise from operators' experiencese [Note: Should be
"experiences"] in deploying and managing large-scale WLANs.
 
a. Operator Requirements"
--XX-

 

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap