Subject: Re: [Capwap] Encryption Capabilities

From: "Nancy Winget (ncamwing)" <[email-masked]>
Date: Thu, 8 Jun 2006 10:20:48 -0700

Hi Charles,

I think we have to be very careful when assertions of .11i providing
CAPWAP protection (unless I misunderstood you).  Since CAPWAP allows
both 802.3 and 802.11 to be tunneled with CAPWAP,  I believe we are only
confusing matters by implying that .11i could be sufficient....that
statement requires a lot of qualification that I think will get missed
by many.

	Nancy.

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Wednesday, June 07, 2006 11:51 AM
To: Pat Calhoun (pacalhou)
Cc: Nancy Winget (ncamwing); [email-masked]
Subject: Re: [Capwap] Encryption Capabilities

Pat Calhoun (pacalhou) wrote:
>> Yes, DTLS provides a superset of security, but also triples the 
>> computational requirements.  My point is that in many cases, the 
>> subset of security offered by 11i encryption is sufficient.
> 
> At the expense of disallowing certain standard 802.11 functions from 
> being provided.
> 

... certainly, that's why like using DTLS, it would be optional.

I'm not trying to say we need to keep it.  I'm just trying to make sure
everyone's aware of the feature it provides.  If implementors think
getting rid of it is fine, then go for it.

Personally, I couldn't care less about computational complexity. 
Terminating 11i at the WTP and optionally using DTLS makes much more
sense in the larger security paradigm.  Then everything's clean and
modular.

--
t. charles clancy, ph.d.  |  [email-masked]  |  www.cs.umd.edu/~clancy
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Charles Clancy <[email-masked]>
Date: Thu, 08 Jun 2006 14:38:40 -0400

Nancy,

... and in the future, hopefully CAPWAP will encapsulate other wireless 
standards as well.  All of which may or may not encrypt their packets.

Just to clarify my thoughts on this thread:

0. When I say "centralized encryption" I mean terminating the RSN 
security at the AC in the 802.11 CAPWAP binding.

1. Removing centralized encryption doesn't change the security of the 
CAPWAP protocol, as it has nothing to do with the CAPWAP headers.

2. Centralized encryption can be used in deployments where the backhaul 
threat model only requires data plane confidentiality, and in this case 
can save processing time on the WTP as per-packet DTLS does not have to 
be done.  If implementors find this useful, then they may want to 
consider keeping it around.

3. In my personal, non-security-advisor, non-normative, humble opinion 
(IM-PNSANN-HO for short), I think terminating encryption at the WTP is 
the most aesthetic from a protocol standpoint.