Subject: [Capwap] Proposed Text for Issue 116: Encryption Policy should use RSNA IE

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Mon, 22 May 2006 13:39:49 -0700

All,

Below is the proposed text for issue 116, which is to replace the
encryption policy flags to instead rely on the RSN Information Element.
Comments welcomed.

11.1.1.  Split MAC

   This section shows the division of labor between the WTP and the AC
   in a Split MAC architecture.  Figure 4 shows the clear separation of
   functionality among CAPWAP components.
[...]
   o  If the WTP is providing encryption/decryption services, once the
      client has completed the IEEE 802.11i key exchange, the AC
      transmits another Add Mobile request to the WTP, stating the
      security policy to enforce for the client (in this case AES-CCMP),
      as well as the encryption key to use.  If encryption/decryption is
      handled in the AC, the IEEE 802.11 Add Mobile Station request
      would not include the RSN Information Element.

[...]

11.10.1.  IEEE 802.11 Add WLAN
[...]
   If present, the RSN information element is sent along with the IEEE
   802.11 Add WLAN in order to instruct the WTP on the usage of the Key
   field.

   Note that ACs MAY include additional information elements as they see
   fit.  The message element uses the following format:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |    Radio ID   |    WLAN ID    |          Capabilities         |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Key Index   |   Key Status  |           Key Length          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                             Key...                            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |      QoS      |   Auth Type   |   MAC Mode    |  Tunnel Mode  |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       | Suppress SSID |    SSID ...
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

   Type:  1024 for IEEE 802.11 Add WLAN

   Length:  >= 49

   Radio ID:  An 8-bit value representing the radio.

   WLAN ID:  An 8-bit value specifying the WLAN Identifier.

   Capability:  A 16-bit value containing the capabilities information
      field to be advertised by the WTP within the Probe and Beacon
      messages.

   Key-Index:  The Key Index associated with the key.

   Key Status:  A 1 byte value that specifies the state and usage of the
      key that has been included.  The following values describe the key
      usage and its status:

   0 - A value of zero, with the inclusion of the RSN Information
      Element means that the WLAN uses per-station encryption keys, and
      therefore the key in the 'Key' field is only used for multicast
      traffic.

   1 - When set to one, the WLAN employs a shared WEP key, also known as
      a static WEP key, and uses the encryption key for both unicast and
      multicast traffic for all stations.

   2 - The value of 2 indicates that the AC will begin rekeying the GTK
      with the STA's in the BSS.  It is only valid when IEEE 802.11i is
      enabled as the security policy for the BSS.

   3 - The value of 3 indicates that the AC has completed rekeying the
      GTK and broadcast packets no longer need to be duplicated and
      transmitted with both GTK's.

   Key Length:  A 16-bit value representing the length of the Key field.

   Key:  A 32 byte Session Key to use to provide data privacy.  For
      static WEP keys, which is true when the 'Key Status' bit is set to
      one, this key is used for both unicast and multicast traffic.  For
      encryption schemes that employ a separate encryption key for
      unicast and multicast traffic, the key included hereonly applies
      to multicast data, and the cipher suite is specified in an
      accompanied RSN Information Element.  In these scenarios, the key,
      and cipher information, is communicated via the Add Mobile Station
      (Section 4.4.8).

[...]
11.10.11.  IEEE 802.11 Mobile Session Key

   The Mobile Session Key Payload message element is sent when the AC
   determines that encryption of a mobile station must be performed in
   the WTP.  This message element MUST NOT be present without the IEEE
   802.11 Mobile (see Section 11.10.10) message element, and MUST NOT be
   sent if the WTP had not specifically advertised support for the
   requested encryption scheme.

   The RSN information element MUST sent along with the IEEE 802.11
   Mobile Session Key in order to instruct the WTP on the usage of the
   Key field.  The AKM field of the RSM information element is used by
   the WTP to identify the authentication protocol.

   If the IEEE 802.11 Mobile Session Key message element's AKM-Only bit
   is set, the WTP MUST drop all IEEE 802.11 packets that are not part
   of the AKM (e.g., EAP).  Note that AKM-Only is MAY be set while an
   encryption key is in force, requiring that the AKM packets be
   encrypted.  Once the mobile station has successfully completed
   authentication via the AKM, the AC must send a new Add Mobile message
   element to remove the AKM-Only restriction, and optionally push the
   session key down to the WTP.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                           MAC Address                         |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |          MAC Address          |A|C|           Flags           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                         Pairwise TSC                          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |         Pairwise TSC          |         Pairwise RSC          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                         Pairwise RSC                          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |    Key...
       +-+-+-+-+-+-+-+-

 [...]
11.10.20.  IEEE 802.11 Update WLAN

   The Update WLAN message element is used by the AC to define a
   wireless LAN on the WTP.  The inclusion of this message element MUST
   also include the IEEE 802.11 Information Element message element,
   containing the following 802.11 IEs:

   Power Capability information element

   WPA information element

   RSN information element

   EDCA Parameter Set information element

   QoS Capability information element

   WMM information element

   The message element uses the following format:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |    Radio ID   |     WLAN ID   |           Capability          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Key Index   |   Key Status  |           Key Length          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                             Key...                            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type:  1043 for IEEE 802.11 Update WLAN

   Length:  43

   Radio ID:  An 8-bit value representing the radio.

   WLAN ID:  An 8-bit value specifying the WLAN Identifier.

   Capability:  A 16-bit value containing the capabilities information
      field to be advertised by the WTP within the Probe and Beacon
      messages.

   Key-Index:  The Key Index associated with the key.

   Key Status:  A 1 byte value that specifies the state and usage of the
      key that has been included.  The following values describe the key
      usage and its status:

   0 - A value of zero, with the inclusion of the RSN Information
      Element means that the WLAN uses per-station encryption keys, and
      therefore the key in the 'Key' field is only used for multicast
      traffic.

   1 - When set to one, the WLAN employs a shared WEP key, also known as
      a static WEP key, and uses the encryption key for both unicast and
      multicast traffic for all stations.

   2 - The value of 2 indicates that the AC will begin rekeying the GTK
      with the STA's in the BSS.  It is only valid when IEEE 802.11i is
      enabled as the security policy for the BSS.

   3 - The value of 3 indicates that the AC has completed rekeying the
      GTK and broadcast packets no longer need to be duplicated and
      transmitted with both GTK's.

   Key Length:  A 16-bit value representing the length of the Key field.

   Key:  A 32 byte Session Key to use to provide data privacy.  For
      static WEP keys, which is true when the 'Key Status' bit is set to
      one, this key is used for both unicast and multicast traffic.  For
      encryption schemes that employ a separate encryption key for
      unicast and multicast traffic, the key included hereonly applies
      to multicast data, and the cipher suite is specified in an
      accompanied RSN Information Element.  In these scenarios, the key,
      and cipher information, is communicated via the Add Mobile Station
      (Section 4.4.8).
[...]

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap