Subject: [Capwap] WGLC: security-analysis-draft-00 (was RE: Review: CAPWAP security analysis draft)

From: "Mani, Mahalingam (Mani)" <[email-masked]>
Date: Wed, 18 Jul 2007 11:11:23 -0600

Following up on this email of June 4th, with no further comments on the
list on the draft - we are hereby calling for the WGLC on the
security-analysis draft (draft-ietf-capwap-threat-analysis-00.txt) and
the last call ends 2 weeks from now: 8/1/07.

Please provide any comments you may have on the draft soon to the list.

thanks,

-mani (for WG chairs)

________________________________

From: Mani, Mahalingam (Mani) 
Sent: Monday, June 04, 2007 10:30 AM
To: capwap
Subject: [Capwap] Review: CAPWAP security analysis draft
Importance: High

Dear WG,

Our Security Area Advisors authored a CAPWAP security analysis draft
<http://www.ietf.org/internet-drafts/draft-ietf-capwap-threat-analysis-0
0.txt>  (-00) - submitted in February 2007. This was discussed in the
Prague IETF session (March 19, 2007) and several short discussions
ensued during and after the meeting.

Due to lack of time it was agreed to take further discussions on this to
the list. Important threat models and assumptions have been proposed in
this draft. It is important and useful

to understand the model we would agree on and if it is met by the
exsiting CAPWAP protocol draft.

The WG is requested to please read and review the draft and post your
comments at the soonest. That would help progress the draft formally in
preparation for WGLC.

Regards,

-mani

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 31 Jul 2007 20:20:16 +0200

In general this is an useful and well written document. The following
comments are provided from the perspective of a contributor. 
 
Technical:
 
Is the scope of the document related to the 802.11 WLAN technology
binding? CAP is designed to be applicable to other wireless
technologies. Would a different threat analysis document be needed for
each of those? I would suggest to clarify this, maybe to add some text
on this respect in the introduction section pointing up what are the
common elements and what are wireless LAN technology specific elements
in the security threat analysis. 
 
Editorial:
 
1. In many places including the title the wireless LAN technology is
referred simply as '802.11'. I suggest that 'IEEE 802.11' is used
consistently instead. 
 
2. [8021X] refers to IEEE 802.1X-2001 edition of the standard. Unless
there are any good reasons to use the older version, which should be
documented, it would be appropriate to use the new edition of the
standard which is IEEE 802.1X-2004. 
 
3. Indicate where can reference [80211SEC] reference be found
 
4. There is a need for an abbreviations section to expand acronyms which
are abundant in sections like Section 3
 
Dan

	From: Mani, Mahalingam (Mani) [mailto:[email-masked]] 
	Sent: Wednesday, July 18, 2007 8:11 PM
	To: capwap
	Subject: [Capwap] WGLC: security-analysis-draft-00 (was RE:
Review: CAPWAPsecurity analysis draft)

	Following up on this email of June 4th, with no further comments
on the list on the draft - we are hereby calling for the WGLC on the
security-analysis draft (draft-ietf-capwap-threat-analysis-00.txt) and
the last call ends 2 weeks from now: 8/1/07.

	Please provide any comments you may have on the draft soon to
the list.

	thanks,

	-mani (for WG chairs)

	Dear WG,

	Our Security Area Advisors authored a CAPWAP security analysis
draft

	Due to lack of time it was agreed to take further discussions on
this to the list. Important threat models and assumptions have been
proposed in this draft. It is important and useful

	to understand the model we would agree on and if it is met by
the exsiting CAPWAP protocol draft.

	The WG is requested to please read and review the draft and post
your comments at the soonest. That would help progress the draft
formally in preparation for WGLC.

	Regards,

	-mani

---

From: Scott G Kelly <[email-masked]>
Date: Tue, 31 Jul 2007 20:24:34 -0700

Hi Dan,

Thanks for taking the time to review this document. Responses inline
below...

> in the security threat analysis. 

It was initially a general analysis, and in fact, some of the
considerations will apply to any binding, but some are quite
specifically related to 802.11. For example, some other binding might
not push cryptographic keys to the AP-equivalent (assuming that binding
has such a thing), so it is conceivable that, e.g., confidentiality
might not a requirement for the control channel. Hard to say.

Anyway, we can try to add some language to clarify this.

> referred simply as '802.11'. I suggest that 'IEEE 802.11' is used
Okay.

> standard which is IEEE 802.1X-2004. 

Cut/paste error, we can fix this.

> 3. Indicate where can reference [80211SEC] reference be found

I assume you mean that you'd like to see the publisher listed? This was
included in the xml, but apparently incorrectly...

> are abundant in sections like Section 3

I don't read every RFC published, but I was under the impression that
the accepted approach is to expand on first usage. After
double-checking, I see that some acronyms are not currently expanded
(e.g. TKIP, AES-CCM). We could expand these, but I'm not sure if that is
what you are asking for.

Has the procedure changed for RFCs, and if so, do we prefer such a
dictionary in an appendix or in an introductory section?

Scott