Subject: Wireless LAN Certificate Extensions

From: "Housley, Russ" <[email-masked]>
Date: Wed, 24 Jul 2002 17:40:33 -0400

At the IETF meeting in Japan last week, I gave a presentation on 
draft-ietf-pkix-wlan-extns-00.txt. I got one question that deserves 
discussion on the list.

The question was: Can the SSID change?  And if so, is there a more stable 
alternative that we could include in the certificate instead.

Yes the SSID can change, but it does not change often.  For example when 
Mobilestar was bought, the SSID was changed to TMOBILE from Mobilestar. 
There isn't a good replacement. One that the authors considered is the 
network name of the RADIUS server/proxy (not the final RADIUS server) which 
would be mobilestar.com in the previous example.  However, this name would 
also change under then same circumstances that cause the SSID to change.

I propose that we stick with SSID as described in the document.

Russ

---

From: Hiroyuki CHIBA <[email-masked]>
Date: Mon, 29 Jul 2002 12:08:39 +0900 (JST)

Hi,

>>>>> On Wed, 24 Jul 2002 17:40:33 -0400,
	"Housley, Russ" <[email-masked]> said
	 about: Wireless LAN Certificate Extensions:

rhousley> At the IETF meeting in Japan last week, I gave a presentation on 
rhousley> draft-ietf-pkix-wlan-extns-00.txt. I got one question that deserves 
rhousley> discussion on the list.

It's my question.

rhousley> The question was: Can the SSID change?  And if so, is there a more stable 
rhousley> alternative that we could include in the certificate instead.

rhousley> Yes the SSID can change, but it does not change often.  For example when 
rhousley> Mobilestar was bought, the SSID was changed to TMOBILE from Mobilestar. 
rhousley> There isn't a good replacement. One that the authors considered is the 
rhousley> network name of the RADIUS server/proxy (not the final RADIUS server) which 
rhousley> would be mobilestar.com in the previous example.  However, this name would 
rhousley> also change under then same circumstances that cause the SSID to change.

rhousley> I propose that we stick with SSID as described in the document.

If this extension can be included in either PKC or AC, we can select
the alternative for a volatile SSID with reduced revocation cost, I think.
Any comments?

----
Hiroyuki CHIBA: [email-masked] [email-masked]
     Security Solution Promoting Division, Hitachi,Ltd.

---

From: "Housley, Russ" <[email-masked]>
Date: Mon, 29 Jul 2002 11:52:39 -0400

>the alternative for a volatile SSID with reduced revocation cost, I think.

I only envision these extensions being included in PKCs.

What do you propose instead of the SSID?   Tim Moore (my co-author) could 
not find an appropriate value that was more stable than the SSID.

Russ

---

From: Hiroyuki CHIBA <[email-masked]>
Date: Tue, 30 Jul 2002 04:01:12 +0900 (JST)

Hi Russ,

>>>>> On Mon, 29 Jul 2002 11:52:39 -0400,
	"Housley, Russ" <[email-masked]> said
	 about: Re: Wireless LAN Certificate Extensions:

rhousley> >rhousley> I propose that we stick with SSID as described in the document.

rhousley> >If this extension can be included in either PKC or AC, we can select
rhousley> >the alternative for a volatile SSID with reduced revocation cost, I think.
rhousley> >Any comments?

rhousley> I only envision these extensions being included in PKCs.
rhousley> What do you propose instead of the SSID?   Tim Moore (my co-author) could 
rhousley> not find an appropriate value that was more stable than the SSID.

I assume that SSIDs will be assigned by wireless-network service
providers or corporate network administrators, and the assignment will
NOT be depend on issuing PKC of the network client.
In other words, a lifecycle of PKC should be different from each SSIDs' .

My proposal is to allow including WLAN SSID EXT. into AC.

Thanks,

----

---

From: "Housley, Russ" <[email-masked]>
Date: Mon, 29 Jul 2002 15:58:25 -0400

Hiroyuki:

Okay, so we agree that the SSID is the appropriate value.

I understand your desire to link the SSID to a certificate after it is 
issued.  This will complicate the application.  First, it would locate the 
AC that contains the desired SSID.  Next, the AC holder field is used to 
locate the PKC.

Russ