Subject: FW: [Capwap] lwapp-dtls edits

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 3 Feb 2006 08:10:43 -0800

Re-sending for Nancy.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> -----Original Message-----
> From: Nancy Winget (ncamwing) 
> Sent: Saturday, January 28, 2006 3:15 PM
> To: Susan Hares; Scott G. Kelly; capwap
> Cc: Pat Calhoun (pacalhou)
> Subject: RE: [Capwap] lwapp-dtls edits
> 
> Scott,
> 
> I also could only do a cursory security review of the current 
> draft as I need more clarification and elaboration on the 
> authentication/authorization enforcement as well as how the 
> rekey mechanisms work. Once I have a better understanding of 
> those, I think we can close loop on the security review.  I 
> think my comments are along the same vein as Sue's.  
> 
> Attached are my comments embedded in the word-(re)formatted draft.
> 
> Thanks,
> 	Nancy.  
> 
> -----Original Message-----
> From: Susan Hares [mailto:[email-masked]]
> Sent: Friday, January 27, 2006 4:39 PM
> To: Scott G. Kelly; capwap
> Cc: Nancy Winget (ncamwing); Pat Calhoun (pacalhou)
> Subject: RE: [Capwap] lwapp-dtls edits
> 
> Scott:
> 
> My focus has been the interaction of the DTLS work with the 
> LWAPP State machine.  The 
> draft-kelley-capwap-lwap-dtls-00.txt gave no state machine 
> interactions.
> 
> The draft-kelley-capwap-lwapp-dtls-01.txt draft gives some 
> state machine interactions, and modifies the LWAPP state machine. 
> 
> However, these state machine interactions do not provide 
> guidance on what to do in the DTLS handshake errors, 
> fragmentation errors, or alert messages.
> 
> I've attached very draft text to guide you in providing the 
> next revision.
> (It's a word document - so let me know if that's a problem.  
> I turned on the revision history and highlighted the suggested text.) 
>   
> I'll do a final DTLS and security review once you finalize 
> your next revision.  
> 
> Pat and I went through a few rounds on the state machine of LWAPP to
> reach the current form.   Glad to do an early review of your 
> text prior
> to release to the working group. 
> 
> Cheers, 
> 
> Sue
> 
> PS - I used (lwapp-03, dtls-05).
> 
>       I sent my comments from Nancy Winget (Cisco).  She may find more
> 	issues with the state machine based on conversations we 
> had at IEEE.
>  
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Nancy Winget (ncamwing)" <[email-masked]>
Date: Fri, 3 Feb 2006 08:40:41 -0800

Though I didn't receive a notice, I'm resending as I have been notified
that this email was rejected.  

Thanks,
	Nancy.

-----Original Message-----
From: Nancy Winget (ncamwing) 
Sent: Saturday, January 28, 2006 3:15 PM
To: 'Susan Hares'; Scott G. Kelly; capwap
Cc: Pat Calhoun (pacalhou)
Subject: RE: [Capwap] lwapp-dtls edits

Scott,

I also could only do a cursory security review of the current draft as I
need more clarification and elaboration on the
authentication/authorization enforcement as well as how the rekey
mechanisms work. Once I have a better understanding of those, I think we
can close loop on the security review.  I think my comments are along
the same vein as Sue's.  

Thanks,
	Nancy.  

-----Original Message-----
From: Susan Hares [mailto:[email-masked]]
Sent: Friday, January 27, 2006 4:39 PM
To: Scott G. Kelly; capwap
Cc: Nancy Winget (ncamwing); Pat Calhoun (pacalhou)
Subject: RE: [Capwap] lwapp-dtls edits

Scott:

My focus has been the interaction of the DTLS work with the LWAPP State
machine.  The draft-kelley-capwap-lwap-dtls-00.txt gave no state machine
interactions.

The draft-kelley-capwap-lwapp-dtls-01.txt draft gives some state machine
interactions, and modifies the LWAPP state machine. 

However, these state machine interactions do not provide guidance on
what to do in the DTLS handshake errors, fragmentation errors, or alert
messages.

I've attached very draft text to guide you in providing the next
revision.
(It's a word document - so let me know if that's a problem.  I turned on
the revision history and highlighted the suggested text.) 
  
I'll do a final DTLS and security review once you finalize your next
revision.  

Pat and I went through a few rounds on the state machine of LWAPP to
reach the current form.   Glad to do an early review of your text prior
to release to the working group. 

Cheers, 

Sue

      I sent my comments from Nancy Winget (Cisco).  She may find more
	issues with the state machine based on conversations we had at
IEEE.

---

From: "Scott G. Kelly" <[email-masked]>
Date: Fri, 3 Feb 2006 15:29:16 -0800 (GMT-08:00)

Just wanted to ack Sue's and Nancy's comments - I've been slammed for the last week, and Eric and I expect to get to this over the weekend...

-----Original Message-----
>From: "Pat Calhoun (pacalhou)" <[email-masked]>
>Sent: Feb 3, 2006 8:10 AM
>To: [email-masked]
>Subject: FW: [Capwap] lwapp-dtls edits
>
>Re-sending for Nancy.
>
>Pat Calhoun

---

From: "Nancy Winget (ncamwing)" <[email-masked]>
Date: Sun, 5 Feb 2006 21:37:47 -0800

Hi Charles,

Thanks for the clarification, I had not implied that the profiles would
carry to the DTLS draft; so I agree, its addition or intent should be
noted in the DTLS draft as well.

Thanks,
	Nancy.  

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Friday, February 03, 2006 6:54 PM
To: Nancy Winget (ncamwing)
Cc: Susan Hares; Scott G. Kelly; capwap
Subject: Re: [Capwap] lwapp-dtls edits

As far as the authentication/authorization, this came up in the original
security review of LWAPP, with regard to the PKI authentication.  The
certificate itself serves to authenticate the party, and I recommended
adding a certificate profile to explicitly include authorization.  The
certificate would say "this guy's allowed to be a WTP for domain
BLAH.NET", for example.

Note that this could also be done on a case-by-case basis, where certs
for authorized WTPs were manually added to the AC, though I imagine this
would generally be frowned upon for large deployments.  You might need a
manual blacklist though, unless you want to start mucking with CRLs.

In any case the LWAPP draft itself includes the text on certificate
profiles.  It might be good to reference that in the DTLS draft.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ] [
computer science ]-----[ university of maryland | college park ]

Nancy Winget (ncamwing) wrote:
> Scott,
> 
> I also could only do a cursory security review of the current draft as

> I need more clarification and elaboration on the 
> mechanisms work. Once I have a better understanding of those, I think 
> we can close loop on the security review.  I think my comments are 
> along the same vein as Sue's.
> 
> My focus has been the interaction of the DTLS work with the LWAPP 
> State machine.  The draft-kelley-capwap-lwap-dtls-00.txt gave no state

> machine interactions.
> 
> The draft-kelley-capwap-lwapp-dtls-01.txt draft gives some state 
> machine interactions, and modifies the LWAPP state machine.
> 
> what to do in the DTLS handshake errors, fragmentation errors, or 
> alert messages.
> 
> (It's a word document - so let me know if that's a problem.  I turned 
> on the revision history and highlighted the suggested text.)
>   
IEEE.
>  
> 
> 
> ----------------------------------------------------------------------
> --
>

---

From: "Susan Hares" <[email-masked]>
Date: Mon, 6 Feb 2006 11:52:13 -0700

Scott:

Found this message indicating you got the document.
Glad to review your next revision before it comes out.

Sue

-----Original Message-----
From: Scott G. Kelly [mailto:[email-masked]] 
Sent: Friday, February 03, 2006 6:29 PM
To: Pat Calhoun (pacalhou); [email-masked]
Subject: Re: FW: [Capwap] lwapp-dtls edits

Just wanted to ack Sue's and Nancy's comments - I've been slammed for
the last week, and Eric and I expect to get to this over the weekend...