Subject: Re: [Capwap] Issue 35: MAC Address in Certificate CN field

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 12 Feb 2008 21:15:34 -0800

Sam,

May I simply adopt your proposed text below and close this issue?

PatC 

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Thursday, January 03, 2008 5:19 AM
To: Pat Calhoun (pacalhou)
Cc: capwap
Subject: Re: [Capwap] Issue 35: MAC Address in Certificate CN field

>>>>> "Pat" == Pat Calhoun (pacalhou) <[email-masked]> writes:

    Pat> The intention is the for AC and WTPs to validate the CN
    Pat> through an access control list. This could be done via a
    Pat> RADIUS request, a locally stored MAC address list, etc. As
    Pat> long as the certificate is valid, and authorized, it really
    Pat> doesn't matter whether the device in question is actually
    Pat> using the MAC address encoded in the CN field, and as you
    Pat> state, this is not possible to do if a router is present.

Ah.
This was not obvious to me.
If the intent is to validate against an ACL, then I think the following
requirement  does not rise to the level needed for an RFC 2119 MUST:

>   The certificate common name (CN) for both the WTP and AC MUST be the
>   MAC address of that device.  The MAC address MUST be formatted as
>   ASCII HEX, e.g. 01:23:45:67:89:ab.

In particular, that's a requirement on operational deployments rather
than a requirement on implementations and if all you are going to do is
to check against an ACL then I don't see a need for that requirement.

Perhaps something more like the following would be an appropriate
requirement to meet interoperability:

>   Capwap implementations MUST support certificates where the  common
name (CN) for both the WTP and AC is the
>   MAC address of that device.  The MAC address MUST be formatted as
>   ASCII HEX, e.g. 01:23:45:67:89:ab.

You should be aware that there is a raging debate in the security
directorate about whether storing MAC addresses in a CN field is
appropriate for a mandatory to implement solution.  I have not read that
debate so I don't know if there is a consensus there one way or another.
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: <[email-masked]>
Date: Wed, 13 Feb 2008 01:12:26 -0600

Ideally the MAC address would not be used as an identifier. Iknow thatäs hard given how much it is used that way.

BR,
Michael

>From: ext Pat Calhoun (pacalhou) [mailto:[email-masked]] 
>Sent: 12 February, 2008 21:16
>To: Sam Hartman
>Cc: capwap
>If the intent is to validate against an ACL, then I think the 
>following requirement  does not rise to the level needed for 
>an RFC 2119 MUST:
>
>In particular, that's a requirement on operational deployments 
>rather than a requirement on implementations and if all you 
>are going to do is to check against an ACL then I don't see a 
>need for that requirement.
>
>Perhaps something more like the following would be an 
>appropriate requirement to meet interoperability:
>
>
>
>You should be aware that there is a raging debate in the 
>security directorate about whether storing MAC addresses in a 
>CN field is appropriate for a mandatory to implement solution. 
> I have not read that debate so I don't know if there is a 
>consensus there one way or another.

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 15 Feb 2008 07:14:00 -0800

All,

The new text reads:

   CAPWAP implementations MUST support certificates where the common
   name (CN) for both the WTP and AC is the MAC address of that device.
   The MAC address MUST be formatted as ASCII HEX, e.g.
   01:23:45:67:89:ab.  Note that the CN field MAY contain either of the
   EUI-48 [22] or EUI-64 [23] MAC Address formats.

PatC 

-----Original Message-----
From: Pat Calhoun (pacalhou) 
Sent: Tuesday, February 12, 2008 9:16 PM
To: Sam Hartman
Cc: capwap
Subject: Re: [Capwap] Issue 35: MAC Address in Certificate CN field

Sam,

PatC 

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]]
Sent: Thursday, January 03, 2008 5:19 AM
To: Pat Calhoun (pacalhou)
Cc: capwap
Subject: Re: [Capwap] Issue 35: MAC Address in Certificate CN field

Ah.