Subject: RE: [Capwap] lwapp-dtls edits

From: "Nancy Winget (ncamwing)" <[email-masked]>
Date: Sat, 28 Jan 2006 15:15:04 -0800

Scott,

I also could only do a cursory security review of the current draft as I
need more clarification and elaboration on the
authentication/authorization enforcement as well as how the rekey
mechanisms work. Once I have a better understanding of those, I think we
can close loop on the security review.  I think my comments are along
the same vein as Sue's.  

Attached are my comments embedded in the word-(re)formatted draft.

Thanks,
	Nancy.  

-----Original Message-----
From: Susan Hares [mailto:[email-masked]] 
Sent: Friday, January 27, 2006 4:39 PM
To: Scott G. Kelly; capwap
Cc: Nancy Winget (ncamwing); Pat Calhoun (pacalhou)
Subject: RE: [Capwap] lwapp-dtls edits

Scott:

My focus has been the interaction of the DTLS work with the LWAPP State
machine.  The draft-kelley-capwap-lwap-dtls-00.txt gave no state machine
interactions.

The draft-kelley-capwap-lwapp-dtls-01.txt draft gives some state machine
interactions, and modifies the LWAPP state machine. 

However, these state machine interactions do not provide guidance on
what to do in the DTLS handshake errors, fragmentation errors, or alert
messages.

I've attached very draft text to guide you in providing the next
revision.
(It's a word document - so let me know if that's a problem.  I turned on
the revision history and highlighted the suggested text.) 
  
I'll do a final DTLS and security review once you finalize your next
revision.  

Pat and I went through a few rounds on the state machine of LWAPP to
reach the current form.   Glad to do an early review of your text prior
to release to the working group. 

Cheers, 

Sue

PS - I used (lwapp-03, dtls-05).

      I sent my comments from Nancy Winget (Cisco).  She may find more
	issues with the state machine based on conversations we had at
IEEE.
 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Charles Clancy <[email-masked]>
Date: Fri, 03 Feb 2006 21:54:07 -0500

As far as the authentication/authorization, this came up in the original 
security review of LWAPP, with regard to the PKI authentication.  The 
certificate itself serves to authenticate the party, and I recommended 
adding a certificate profile to explicitly include authorization.  The 
certificate would say "this guy's allowed to be a WTP for domain 
BLAH.NET", for example.

Note that this could also be done on a case-by-case basis, where certs 
for authorized WTPs were manually added to the AC, though I imagine this 
would generally be frowned upon for large deployments.  You might need a 
manual blacklist though, unless you want to start mucking with CRLs.

In any case the LWAPP draft itself includes the text on certificate 
profiles.  It might be good to reference that in the DTLS draft.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

Nancy Winget (ncamwing) wrote:
> ------------------------------------------------------------------------
>