Subject: [Capwap] lwapp-dtls: section 3

From: Scott G Kelly <[email-masked]>
Date: Mon, 13 Feb 2006 07:06:55 -0800

> 1.Endpoint Authentication using DTLS
> 
> [NCW] I would like to see a security considerations sections for the
> different authentication methods using DTLS.  The current LWAPP
> specification enforces mutual authentication through Join
> request/response exchange requiring each participant to present a
> credential.  This is not enforced in TLS and thus can lead to
> different security threat considerations.
> 
> Currently, LWAPP supports authentication using either public key 
> certificates or shared secrets (pre-shared keys).  DTLS support 
> implies no changes in this regard.  Certificate-based authentication 
> is natively supported, and support for preshared keys is currently 
> progressing toward standardization (see [TLS-PSK]).  Below we 
> describe supported TLS algorithm suites for each endpoint

We've assumed so far that we're requiring client authentication, 
although I know of at least one person who wants support for server-side 
auth only in some cases. If we state this explicitly, then the security 
considerations are the same as for the existing lwapp mechanisms. Does 
this address your concern?

Scott

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap