Subject: [Capwap] FW: COMMENT: draft-ietf-capwap-objectives

From: "Mani, Mahalingam (Mani)" <[email-masked]>
Date: Thu, 16 Feb 2006 08:40:05 -0700

Comments streaming in from IESG on Objectives draft...

-mani
======

-----Original Message-----
From: Brian Carpenter [mailto:[email-masked]] 
Sent: Thursday, February 16, 2006 2:22 AM
To: [email-masked]
Cc: Mani, Mahalingam (Mani); [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]
Subject: COMMENT: draft-ietf-capwap-objectives 

Comment:
>   Protocol Requirement:
>
>   The CAPWAP protocol MUST support mutual authentication of WTPs and
>   the centralized controller.  It must also ensure that information
>   exchanges between them are secured.

Does that mean encrypted or only integrity-protected?

>   Protocol Requirement:
>
>   The design of the CAPWAP protocol MUST NOT allow for any compromises
>   to the WLAN system by external entities.

Strange phrasing. Suggestion:

   The design of the CAPWAP protocol MUST protect against any
compromises
   of the WLAN system by external entities.

>   Protocol Requirement:
>
>   Any WTP or WLAN controller vendor or any person MUST be able to
>   implement the CAPWAP protocol from the specification itself and by
>   that it is required that all such implementations do interoperate.

Since this is a basic requirement of all IETF standards, why is it
listed?

> 5.2.  Desirable Objectives

Why aren't the items in this section listed as SHOULD instead of MUST?

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "T. Charles Clancy" <[email-masked]>
Date: Thu, 16 Feb 2006 11:02:08 -0500 (EST)

> Does that mean encrypted or only integrity-protected?

I think we meant at least integrity protected.  Suggest:

The CAPWAP protocol MUST support mutual authentication of WTPs and the 
centralized controller.  It also MUST ensure that information exchanges 
are integrity protected, and SHOULD ensure confidentiality through 
encryption."

>   compromises of the WLAN system by external entities.

Seems reasonable to me.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

---

From: "David T. Perkins" <[email-masked]>
Date: Thu, 16 Feb 2006 11:45:40 -0800 (PST)

HI,

Sorry if this is answered by context....

CAPWAP consists of
1) control messages (actions, configuration, status, and statistics)
2) tunneling of WLAN client traffic
3) system image transfer from an AC to WTPs

Are the same security services needed for all operations?
And can there be different security services provided
for, say, CAPWAP control messages than tunnelled WLAN client
traffic?

> [ computer science ]-----[ university of maryland | college park ]

Regards,
/david t. perkins