Subject: Re: [Capwap] Encryption Capabilities

From: "Bob O'Hara (boohara)" <[email-masked]>
Date: Tue, 6 Jun 2006 09:36:11 -0700

Dorothy,
 
Given that protection of the CAPWAP data packet is (optionally)
available using DTLS in -01, why should we also include an optional
binding-specific protection mechanism that protects only the
encapsulated 802.11 data frame?  This seems to me to be two ways to do
the same thing, with one of those ways available only when the binding
is 802.11.
 
I suggest that we standardize on the DTLS method, which would be
available to any binding and eliminate the 802.11-encrypted mechanism.

 -Bob

________________________________

From: Dorothy Stanley [mailto:[email-masked]] 
Sent: Monday, June 05, 2006 5:04 PM
To: Pat Calhoun (pacalhou)
Cc: [email-masked]
Subject: Re: [Capwap] Encryption Capabilities

I do not agree with always requiring the WTP to provide wireless
encryption. The split MAC architecture allows 802.11
encryption/decryption
at either the WTP or the AC, and this flexibility should be retained,
with use of the
field in question clearly defined.

Dorothy

On 6/5/06, Pat Calhoun (pacalhou) <[email-masked]> wrote: 

	Actually, this field was intended to allow the WTP to
communicate whether it is capable of providing its capabilities, and
therefore allow the AC to determine whether it should perform
centralized encryption. However, with the transition to DTLS, I propose
that we always require the WTP to provide wireless encryption, and use
DTLS between the AC and the WTP. 

	Pat Calhoun
	CTO, Wireless Networking Business Unit
	Cisco Systems

________________________________

		From: Michael Montemurro
[mailto:[email-masked]] 
		Sent: Saturday, June 03, 2006 12:12 PM
		To: David T. Perkins
		Cc: [email-masked]
		Subject: Re: [Capwap] Encryption Capabilities

	David,
	 
	Would it be sufficient to move Encryption Capabilities from the
WTP Descriptor (Section 4.4.34) to the WTP Radio Information message
element (Section 4.4.39)?
	 
	Mike

	On 6/3/06, Michael Montemurro <[email-masked]>
wrote: 

		David, 
		
		I've created issue 125 to track this issue.
		 
		Mike

		On 6/1/06, David T. Perkins <[email-masked] >
wrote: 

			HI,
			
			The "(4.4.34)WTP Descriptor" message element has
the
			subfield "encryption capabilities". What is this
used 
			for? If for radios, then it should be per radio.
If
			for the user data between the WTP and AC, then
			it doesn't seem appropriate to say the value is
			defined by "specific binding" definitions
because
			the WTP can be supporting multiple radios with
			some that provide encryption services and some
			that don't.
			
			In general, I don't feel that this subfield is
			well defined, and it appears to me that it
			should be a per radio attribute. 
			
			Regards,
			/david t. perkins

_________________________________________________________________
			To unsubscribe or modify your subscription
options, please visit:
	
http://lists.frascone.com/mailman/listinfo/capwap 
			
			Archives:
http://lists.frascone.com/pipermail/capwap 

_________________________________________________________________
	To unsubscribe or modify your subscription options, please
visit:
	http://lists.frascone.com/mailman/listinfo/capwap
	
	Archives: http://lists.frascone.com/pipermail/capwap 

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Dorothy Stanley" <[email-masked]>
Date: Tue, 6 Jun 2006 11:07:21 -0700

Bob,

Perhaps we are talking about two different "same things".
One  function is to terminate the 802.11 encryption, another is
to protect the CAPWAP data packets as they traverse the WTP to AC link.
The later could be optionally provided by DTLS.

The 802.11 local and split MAC architectures are intended to allow
multiple options  - including the ability to terminate the 802.11 encryption
at the
AC.  My statement was that the ability to do this provides architectural
flexibility
to 802.11 systems and should not be removed.

Use of DTLS to protect CAPWAP data packets is a separate, general CAPWAP
capability.

Dorothy

On 6/6/06, Bob O'Hara (boohara) <[email-masked]> wrote:
>
>  Dorothy,
>
> Given that protection of the CAPWAP data packet is (optionally) available
> using DTLS in -01, why should we also include an optional binding-specific
> protection mechanism that protects only the encapsulated 802.11 data
> frame?  This seems to me to be two ways to do the same thing, with one of
> those ways available only when the binding is 802.11.
>
> I suggest that we standardize on the DTLS method, which would be available
> to any binding and eliminate the 802.11-encrypted mechanism.
>
>  -Bob
>
>
>
>  ------------------------------
> *From:* Dorothy Stanley [mailto:[email-masked]]
> *Sent:* Monday, June 05, 2006 5:04 PM
> *To:* Pat Calhoun (pacalhou)
> *Cc:* [email-masked]
>
> *Subject:* Re: [Capwap] Encryption Capabilities
>
>
> encryption. The split MAC architecture allows 802.11 encryption/decryption
> at either the WTP or the AC, and this flexibility should be retained, with
> use of the
> >  Actually, this field was intended to allow the WTP to communicate
> > whether it is capable of providing its capabilities, and therefore allow the
> > AC to determine whether it should perform centralized encryption. However,
> > with the transition to DTLS, I propose that we always require the WTP to
> > provide wireless encryption, and use DTLS between the AC and the WTP.
> >
> >
> > Pat Calhoun
> >  ------------------------------
> > *From:* Michael Montemurro [mailto:[email-masked]]
> >
> > *Sent:* Saturday, June 03, 2006 12:12 PM
> > *To:* David T. Perkins
> > *Cc:* [email-masked]
> > *Subject:* Re: [Capwap] Encryption Capabilities
> >
> >  David,
> >
> > Would it be sufficient to move Encryption Capabilities from the WTP
> > Descriptor (Section 4.4.34) to the WTP Radio Information message element
> > (Section 4.4.39)?
> >
> > Mike
> >
> >
> > On 6/3/06, Michael Montemurro <[email-masked]> wrote:
> >
> > >  David,
> >
> >  On 6/1/06, David T. Perkins <[email-masked] > wrote:
> >
> > > HI,
> >
> > The "(4.4.34)WTP Descriptor" message element has the
> > subfield "encryption capabilities". What is this used
> > for? If for radios, then it should be per radio. If
> > defined by "specific binding" definitions because