Subject: [Capwap] Proposed Resolution to Issue 135: have a possible application for CAPWAP that involves running the WTP/wasRe: RC4 Encryption?

From: "Dorothy Stanley" <[email-masked]>
Date: Wed, 14 Jun 2006 14:36:52 -0700

All,

Proposed resolution to Issue 135:

Close, no change to the draft, include Charles' and Eric's comments
as the reasons for not supporting the RC4 cipher.

Comments?.

Thanks,

Dorothy

On 6/8/06, Michael Montemurro <[email-masked]> wrote:
>
> I've capture this as issue 135
>
>
> On 6/6/06, Charles Clancy <[email-masked]> wrote:
> >
> > Are you suggesting adding DTLS ciphersuites such as
> > TLS_RSA_WITH_RC4_128_SHA and TLS_PSK_WITH_RC4_128_SHA?
> >
> > There's a fundamental problem when using RC4 with DTLS (that
> > incidentally does not appear to be addressed in RFC 4279).  In
> > particular, we seed the KDF and use its never-ending output to encrypt
> > data by XORing it with the plaintext packets.  However in DTLS, we can
> > lose packets.  This means gaps in the keystream, and the key states
> > become out of sync.  The only way to fix this is to do what WEP did,
> > with per-packet IVs, and then you get all the same problems found in
> > WEP.
> >
> > So, as-is, RC4 ciphersuites don't work well with DTLS, and if we fix
> > them, we introduce security problems.
> >
> > --
> > t. charles clancy, ph.d.  <>  [email-masked]  <>   www.cs.umd.edu/~clancy<http://www.cs.umd.edu/%7Eclancy>
> >
> > Margaret Wasserman wrote:
> > > Hi All,
> > >
> > > I tried to send a message to the list on this topic a while back, but
> > I
> > > don't think it ever went out...  Sorry if this is a duplicate.
> > >
> > > I have a possible application for CAPWAP that involves running the WTP
> > > portion on a DSP-only device.  In that situation, it will be very
> > difficult
> > > to support AES encryption, due to the processing overhead.
> > >
> > > Would the WG consider supporting a lighter weight algorithm for
> > encryption,
> > > such as RC4?  We could state that AES is preferred when possible, but
> > make
> > > RC4 an accepted option in cases where the hardware would not support
> > the
> > > processing overhead of AES encryption.
> > >
> > > Thoughts?
> > >
> > > Margaret
> > >
> > >
> > > _________________________________________________________________
> > > To unsubscribe or modify your subscription options, please visit:
> > > http://lists.frascone.com/mailman/listinfo/capwap
> > >
> > > Archives: http://lists.frascone.com/pipermail/capwap
> >
> > _________________________________________________________________
> > To unsubscribe or modify your subscription options, please visit:
> > http://lists.frascone.com/mailman/listinfo/capwap
> >
> > Archives: http://lists.frascone.com/pipermail/capwap
> >
>
>
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/capwap
>
> Archives: http://lists.frascone.com/pipermail/capwap
>
>
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Scott G. Kelly" <[email-masked]>
Date: Wed, 14 Jun 2006 14:40:05 -0700 (GMT-07:00)

Agree.

-----Original Message-----
>From: Dorothy Stanley <[email-masked]>
>Sent: Jun 14, 2006 2:36 PM
>To: Michael Montemurro <[email-masked]>
>Cc: [email-masked], Margaret Wasserman <[email-masked]>
>Subject: [Capwap] Proposed Resolution to Issue 135: have a possible	application for CAPWAP that involves running the WTP/wasRe:	RC4 Encryption?
>
>All,
>