Subject: Re: [Capwap] Issue 43 - update

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 22 Sep 2006 13:17:47 -0700

Margaret,

You sort-of got it right the first time. We currently support two modes
of operations; one where the authentication and crypto occur in the AC
and a second where the crypto is in the WTP. So we already support both
modes of operation already. What Saravanan is looking for, is to split
the authenticator responsibilities across both the AC and the WTP, so
message 3 of the 802.11i key handshake can be handled in the WTP (vs.
the AC).

Such a change does not increase the level of conformity to the 802.11i
protocol - it simply provides another optional architecture.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> -----Original Message-----
> From: Margaret Wasserman [mailto:[email-masked]] 
> Sent: Thursday, September 21, 2006 4:31 AM
> To: Margaret Wasserman
> Cc: Saravanan Govindan; [email-masked]
> Subject: Re: [Capwap] Issue 43 - update
> 
> 
> 
> Sorry, Saravan...  I got this backwards.  I realize that you 
> are talking about the case where the authenticator is on the 
> AC and the encryption is on the WTP.
> 
> Please mentally insert "AC" everywhere that I have used "WTP" below.
> 
> Margaret
> 
> On Sep 21, 2006, at 6:28 AM, Margaret Wasserman wrote:
> 
> >
> > Hi Saravan,
> >
> > You would probably make more headway in this discussion if 
> you could 
> > describe a use case where it is necessary (or considerably more
> > desirable) to have the authenticator on the WTP.
> >
> > Do you believe that it is necessary to allow the 
> authenticator to run 
> > on the WTP in order to fully support IEEE 802.11i? If so, could you 
> > please let us know why?  Several people in the group seem 
> to believe 
> > that IEEE 802.11i is fully supported by the current specification.
> >
> > Is there something that will work properly when the 
> authenticator is 
> > on the WTP that won't work properly when the authenticator 
> is on the 
> > AC?  If we've missed some important use case here, please 
> let us know 
> > what it is.
> >
> > Are there cases where some significant performance increase 
> is enabled 
> > by moving the authenticator (in addition to the encryption
> > code)  to the WTP?  If so, please explain.
> >
> > If you could tell us what the technical advantages are to 
> allowing the 
> > authenticator to run on the WTP, we could weigh those 
> advantages and 
> > see if they are worth the added complexity of supporting 
> this option 
> > in the specification.
> >
> > At the moment, the only argument you are giving for why we should 
> > support having the authenticator on the WTP is that we once 
> thought we 
> > would need to do that in order to support IEEE 802.11.  However, 
> > several WG members now believe that we were mistaken in 
> that detail, 
> > because they believe that the current spec does fully support IEEE 
> > 802.11i without that option.  If you want to convince us otherwise, 
> > you will need to explain how the current specification 
> fails to fully 
> > support IEEE 802.11i or offer another compelling technical 
> reason for 
> > adding this option.
> >
> > Thanks,
> > Margaret
> >
> >
> > On Sep 21, 2006, at 6:05 AM, Saravanan Govindan wrote:
> >
> >> All,
> >>
> >> There have been a number of exchanges on CAPWAP's support for the 
> >> requirement on IEEE 802.11i Considerations.
> >>
> >> I continue to believe that the protocol must address the case for 
> >> 802.11i authenticator and crypto elements being on different 
> >> entities.
> >> The objective was designed based on market realities that the 
> >> Architecture Taxonomy highlighted.
> >>
> >> This is a technical issue for which, a technical proposal is being 
> >> made.
> >> However, opinions seem to focus on perception of protocol 
> behaviour.
> >>
> >> I suggest a closer look at the mandatory objective in 
> relation to the 
> >> current CAPWAP specifications.
> >>
> >> Saravanan
> >>
> >>
> >> _________________________________________________________________
> >> To unsubscribe or modify your subscription options, please visit:
> >> http://lists.frascone.com/mailman/listinfo/capwap
> >>
> >> Archives: http://lists.frascone.com/pipermail/capwap
> >
> > _________________________________________________________________
> > To unsubscribe or modify your subscription options, please visit:
> > http://lists.frascone.com/mailman/listinfo/capwap
> >
> > Archives: http://lists.frascone.com/pipermail/capwap
> 
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/capwap
> 
> Archives: http://lists.frascone.com/pipermail/capwap
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap