Subject: Re: [Capwap] CONSENSUS CHECK: Proposed resolution to Issue 43

From: "Saravanan Govindan" <[email-masked]>
Date: Tue, 5 Dec 2006 09:24:13 +0800

Hi Margaret,

Thank you for the clarification.

Given that we know the approach of using non-exact values of KeyRSC
introduce vulnerabilities, I am hesitant to agree with it. I do not
think we should release specifications with known flaws without
providing an alternative. 

One way would be include more insight on the approach of using exact
KeyRSC values. The analysis Scott Kelly provides gives such insight. 

http://lists.frascone.com/pipermail/capwap/msg03682.html

Cheers,

Saravanan

-----Original Message-----
From: Margaret Wasserman [mailto:[email-masked]] 
Sent: Tuesday, December 05, 2006 3:50 AM
To: Saravanan Govindan
Cc: capwap
Subject: Re: [Capwap] CONSENSUS CHECK: Proposed resolution to Issue 43

On Dec 3, 2006, at 8:31 PM, Saravanan Govindan wrote:

> Hi Margaret,
>
> In the spirit of moving forward to consensus, I agree with the  
> option of
> including text about the 2 approaches to 802.11i.

Our current rough consensus (unless we find otherwise before  
Wednesday) is to document only one approach:  use zero, unless  the  
AC is aware of a more optimal value.  Unless there are sufficient  
objections to overcome our consensus from the WG meeting, the plan is  
to document only that one approach, not to document both approaches  
and allow implementors and/or users to choose.

> However I feel strongly about the specific text. The current proposal
> suggests that the option of using exact KeyRSC values is complex. I
> think this is a decision to be made by implementers based on their
> priorities ~ full security vs. OK-security.
>
> My suggestion is to edit the text (from my email on 29 November) to
> clarify how exact KeyRSC values can be used and that it may be used to
> fully overcome the vulnerability that is discussed.

This text is at odds with the analysis of our security advisors, who  
found that both approaches has security vulnerabilities.

Thanks,
Margaret

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap