Subject: Re: [Capwap] New mux header for CAPWAP

From: "Nancy Winget (ncamwing)" <[email-masked]>
Date: Thu, 8 Jun 2006 20:03:15 -0700

Ah, but DTLS is instantiated with an application in mind and that is
where the analysis becomes interesting....that is, how it is applied to
the application, in our case, CAPWAP.  I've no doubt you have a workable
implementation, but implementation does not provide for good security or
means to analyze the general security of the protocol.  

	Nancy.

-----Original Message-----
From: Scott G. Kelly [mailto:[email-masked]] 
Sent: Thursday, June 08, 2006 4:43 PM
To: Nancy Winget (ncamwing); [email-masked];
[email-masked]
Subject: RE: [Capwap] New mux header for CAPWAP

Hi Nanciy,

>I disagree....if it is independent of transport encapsulation then why 
>for example is it DTLS vs. TLS?  We chose DTLS because it uses the UDP 
>model....we are now tweaking this by introducing the concept of a MUX.
>Having lived through the WEP debacle, I am merely stating that there 
>may be repercusions that need further analysis.

It is DTLS precisely because it is *not* dependent on the underlying
transport, whereas TLS *is*. That's why TLS is not an option, but DTLS
is. We chose DTLS because it uses the *connectionless* (or datagram)
model - not UDP in particular. And adding a PDU type identifier is
simply another layered datagram protocol. There are no security
implications introduced by this modification.

>I do not believe this is a non-existant issue, nor is it nonsense to 
>those trying to analyze the security behind CAPWAP.  It is something 
>I'm highlighting as complicating the analysis....maybe not for you, but

>it will to those analyzing the security of this.

If you do such an analysis, I think you will find that one elegant
feature of DTLS is that it does not matter what you wrap it in. It can
be wrapped in connection-oriented or connectionless protocols, and it
can even be multiplexed across both simultaneously - I have actually
implemented this. It's very cool in that regard.

Scott
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Scott G Kelly <[email-masked]>
Date: Fri, 09 Jun 2006 06:20:05 -0700

Hi Nancy,

> means to analyze the general security of the protocol.  

Let's not debate what could or might be. Rather, please do your analysis 
and provide us with your results.

Scott

---

From: <[email-masked]>
Date: Fri, 9 Jun 2006 07:20:24 -0700

Hi Scott,

Did you see any trouble with control frames having high(er) latency when
running several VoIP calls through the WTPs with the MUX?

Best Regards,
Michael  

-----Original Message-----
From: ext Scott G Kelly [mailto:[email-masked]] 
Sent: Friday, June 09, 2006 6:20 AM
To: Nancy Winget (ncamwing)
Cc: [email-masked]; Gellert Dorothy (Nokia-ES/MtView)
Subject: Re: [Capwap] New mux header for CAPWAP

Hi Nancy,

Nancy Winget (ncamwing) wrote:
> where the analysis becomes interesting....that is, how it is applied 
> to the application, in our case, CAPWAP.  I've no doubt you have a 
> workable implementation, but implementation does not provide for good 
> security or means to analyze the general security of the protocol.

Scott