Subject: [Capwap] Threat analysis update and WG last call.

From: "Mani, Mahalingam (Mani)" <[email-masked]>
Date: Thu, 11 Sep 2008 11:24:24 -0600

The following comment by Pasi Eronen against -03 version of the draft
(and a proposed alternate text - thanks Pasi):

=====================================================

The text in Section 10.1.1.1 is pretty good, but it still doesn't
mention the vulnerabilities that arise if you try to do zero
configuration.

Perhaps something like this?

"It should be noted that authorization and zero configuration are not
fully compatible. Even if the WTPs and the ACs are shipped with
manufacturer-provided certificates, the WTPs need to know who the
correct AC is in this deployment (as opposed to other ACs from the same
vendor, purchased and controlled by an adversary), and the AC needs to
know which WTPs are part of this deployment (as opposed to WTPs
purchased and controlled by an adversary).

The threat analysis in this document assumes that WTPs can identify the
correct AC, and the AC can identify the correct WTPs. Analysis of
situations where either of these assumptions is not true is beyond the
scope of this document."

=====================================================

has been addressed in -04. This is a one-week WGLC call for this change
in -04 version of the threat analysis draft.

If you have any comments on this response do post them before September
19, 2008.

Thanks,

-mani

=============

Mahalingam Mani

(408)321-4840 (w)

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Mani, Mahalingam (Mani)" <[email-masked]>
Date: Fri, 19 Sep 2008 10:27:51 -0600

We have received no comments/issues on the Threat analysis draft - on
the sections impacted by changes through -03 and -04 nor remainder of
the draft for the past

one week.

This completes the WGLC on draft-ietf-capwap-threat-analysis
<http://www.ietf.org/internet-drafts/draft-ietf-capwap-threat-analysis-0
4.txt> 

-mani

________________________________

From: Mani, Mahalingam (Mani) [mailto:[email-masked]] 
Sent: Thursday, September 11, 2008 10:24 AM
To: capwap
Cc: [email-masked]
Subject: [Capwap] Threat analysis update and WG last call.

Thanks,

-mani

=============

Mahalingam Mani

(408)321-4840 (w)