Subject: RE: [Capwap] IEEE Review 13 - Protocol security

From: "Saravanan Govindan" <[email-masked]>
Date: Thu, 2 Jun 2005 17:00:46 +0800

Dan, Darren,

In order to better describe the need for mutual authentication, could we
add the following text in the Motivation section?

Motivation:
Existing text:
WLANs are increasingly deployed in critical aspects of enterprise and
consumer networks.  In these contexts, protocol security is crucial to
assure the privacy and integrity expected from network administrators
and end-users.  So securing the CAPWAP protocol has direct benefits in
addressing these concerns.

Proposed change:
WLANs are increasingly deployed in critical aspects of enterprise and
consumer networks.  In these contexts, protocol security is crucial to
assure the privacy and integrity expected from network administrators
and end-users.  So securing the CAPWAP protocol has direct benefits in
addressing these concerns.

"In many cases, the network path between a WTP and WLAN controller
contains untrusted links. Such links could be leveraged by rogue WTPs to
gain access to the WLAN system. They could also be used by rogue ACs to
gain control of legitimate WTPs and their associated terminals to either
redirect or compromise terminal traffic. These security concerns can be
mitigated with this objective."

Cheers,

Saravanan

> -----Original Message-----
> From: Darren Loher [mailto:[email-masked]] 
> Sent: Thursday, June 02, 2005 7:05 AM
> To: Dan Harkins; Saravanan Govindan
> Cc: [email-masked]
> Subject: RE: [Capwap] IEEE Review 13 - Protocol security 
> 
> If the path between a WTP and a AC contains an untrusted 
> link(s), then there is a possibility of a Rogue-AC.  If the 
> path between the WTP and AC contains a wireless link then the 
> likelyhood of a rogue AC seems just as likely as a Rogue-WTP.  
> 
> Such a configuration is a reasonable scenario.  Wifi hotspot 
> providers often operate over an un-trusted network between 
> the AC and the WTP.
> Often it is desirable for an enterprise to use their shared 
> wired infrastructure for management between WTP's and AC's.  
> This shared network may be trusted for general systems 
> access, but not for network control.  
> 
> In many scenarios, having AC - WTP communition on the wired 
> network is only a minor security advantage.  There's the FBI 
> Computer Crime and Security survey that listed 45% of 
> respondents saying they have detected unauthorized access by 
> insiders.  Quotes from the 2003 report at 
> http://www.crime-research.org/news/01.06.2004/283/
> 
> I strongly support mutual authentication as a "MUST" have requirement.
> 
> -Darren
> 
> 
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]] On Behalf Of Dan Harkins
> > Sent: Wednesday, June 01, 2005 9:33 AM
> > To: Saravanan Govindan
> > Cc: [email-masked]
> > Subject: Re: [Capwap] IEEE Review 13 - Protocol security
> > 
> >   Saravanan,
> > 
> >   I clearly understand the threat posed by a "rogue WTP" 
> but what is 
> > the threat posed by a "rogue AC"? A CAPWAP-capable WTP is 
> not service 
> > providing all by its lonesome. It requires an AC to provision and 
> > control it, and to forward packets for its associated STAs. 
> With that 
> > in mind the only thing I can see a "rogue AC" doing is analagous to 
> > physical theft.
> > It can induce WTPs to be controlled and provisioned by it 
> instead of a 
> > different, legitimate, AC. It cannot gain access to a wired 
> network, 
> > only put a WTP's associated STAs on its network (if it has one).
> > 
> >   If the "rogue AC" is something CAPWAP MUST prevent then 
> I'd like to 
> > see some text describing the threat to justify it. If the "rogue AC"
> > is not something that CAPWAP MUST prevent (i.e. it SHOULD
> > prevent) then the requirement for mutual authentication 
> should also be 
> > a SHOULD.
> > 
> >   Dan.
> > 
> > On Wed, 01 Jun 2005 18:22:24 +0800 you wrote
> > > Section 5.1.8 - CAPWAP Protocol Secuirty (Description)
> > > 
> > > Comment:
> > > 
> > > Justify mutual authentication requirement
> > > 
> > > 
> > > Existing text:
> > > 
> > > The CAPWAP protocol must first provide for the
> > participating entities
> > > - WLAN controller and WTPs - to be mutually authenticated.  
> > This is to
> > > ensure that rogue WTPs do not breach legitimate WLAN 
> systems.  For 
> > > example, WTPs may need to regularly renew their
> > authentication state
> > > with the WLAN controller.
> > > 
> > > 
> > > Proposed change:
> > > 
> > > The following changes include text from Charles Clancy. 
> > > 
> > > "The CAPWAP protocol must first provide for the
> > participating entities
> > > - WLAN controller and WTPs - to be mutually authenticated.  
> > This is to
> > > ensure that rogue elements do not gain access to the WLAN system. 
> > > Rogue WTPs should not be allowed to breahch legitimate 
> WLANs and at 
> > > the same time rogue WLAN controllers should not be 
> allowed to gain 
> > > control of legitimate WTPs. For example, WTPs may need to 
> regularly 
> > > renew their authentication state with the WLAN controller and 
> > > similarly for WLAN controllers.
> > > 
> > > If authentication is performed via an authenticated key exchange, 
> > > future knowledge of derived keys is not sufficient for
> > authentication.
> > > 
> > > Any session keys used between the AC and WTP MUST be
> > mutually drived
> > > using entropy contributed by both parties.  This ensures
> > that no one
> > > party has control over the resulting session keys."
> > > :
> > > :
> > > "CAPWAP should not prevent the use of asymmetric
> > authentication.  The
> > > security considerations of such asymmetric authentication are 
> > > described in the Security Considerations section."
> > > _______________________________________________
> > > Capwap mailing list
> > > [email-masked]
> > > http://mail.frascone.com/mailman/listinfo/capwap
> > > 
> > _______________________________________________
> > Capwap mailing list
> > [email-masked]
> > http://mail.frascone.com/mailman/listinfo/capwap
> > 
> 
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: "Pat Calhoun" <[email-masked]>
Date: Thu, 2 Jun 2005 06:58:20 -0700

Works for me.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> [mailto:[email-masked]] On Behalf Of Saravanan Govindan
> Sent: Thursday, June 02, 2005 2:01 AM
> To: Darren Loher; Dan Harkins
> Cc: [email-masked]
> In order to better describe the need for mutual 
> authentication, could we add the following text in the 
> Motivation section?
> 
> Motivation:
> Existing text:
> WLANs are increasingly deployed in critical aspects of 
> enterprise and consumer networks.  In these contexts, 
> protocol security is crucial to assure the privacy and 
> integrity expected from network administrators and end-users. 
>  So securing the CAPWAP protocol has direct benefits in 
> WLANs are increasingly deployed in critical aspects of 
> enterprise and consumer networks.  In these contexts, 
> protocol security is crucial to assure the privacy and 
> integrity expected from network administrators and end-users. 
>  So securing the CAPWAP protocol has direct benefits in 
> "In many cases, the network path between a WTP and WLAN 
> controller contains untrusted links. Such links could be 
> leveraged by rogue WTPs to gain access to the WLAN system. 
> They could also be used by rogue ACs to gain control of 
> legitimate WTPs and their associated terminals to either 
> redirect or compromise terminal traffic. These security 
> concerns can be mitigated with this objective."
> 
> Cheers,
> 
> Saravanan
> 
> 
> 
> 
> link(s), then 
> > there is a possibility of a Rogue-AC.  If the path between 
> the WTP and 
> > AC contains a wireless link then the likelyhood of a rogue AC seems 
> > just as likely as a Rogue-WTP.
> > 
> > Such a configuration is a reasonable scenario.  Wifi 
> hotspot providers 
> > often operate over an un-trusted network between the AC and the WTP.
> > Often it is desirable for an enterprise to use their shared wired 
> > infrastructure for management between WTP's and AC's.
> network is 
> > only a minor security advantage.  There's the FBI Computer 
> Crime and 
> > Security survey that listed 45% of respondents saying they have 
> > detected unauthorized access by insiders.  Quotes from the 
> 2003 report 
> > at http://www.crime-research.org/news/01.06.2004/283/
> >