Subject: [Capwap] Issue 240: Discovery Attack on established DTLS session

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 26 Jan 2007 13:19:48 -0800

During the interim meeting, the issue of what an AC should do if it
receives a 
Discovery Request when it already has an active DTLS session. The
agreement 
was to include text to provide guidance to the implementors.

Find proposed text below:
<text>
5.1.  Discovery Request Message
[...]
   It is possible for the AC to receive a cleartext Discovery Request
   while a DTLS session is already active with the WTP.  This is most
   likely the case where the WTP has rebooted, perhaps due to a software
   or power failure, but could also be caused by a Denial of Service
   attack.  In such cases, any state associated with the WTP, such as
   the state machine instance, MUST NOT be cleared until such time as
   another DTLS session has been successfully established, communicated
   via the DTLSSessionEstablished DTLS notification (see
   Section 2.3.2.2).

12.  Security Considerations
[...]
12.3.  Discovery Attacks

   Since the Discovery Requests are sent in the clear, it is important
   that AC implementations NOT assume that receiving such a request from
   a WTP implies that it has rebooted, and consequently tear down any
   active DTLS sessions.  Discovery Requests can easily be spoofed by
   malicious devices, so it is important that the AC maintain two
   separate sets of states for the WTP until such time as the
   DTLSSessionEstablished notification is received, which implies the
   WTP was authenticated.  Once a new DTLS session is successfully
   established, any state referring to the old session can be cleared.
</text> 

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap