Subject: [Capwap] Taxonomy v06 ready for review

From: "Yang, Lily L" <[email-masked]>
Date: Fri, 12 Nov 2004 07:04:13 -0800

Hi, 
At the IETF CAPWAP meeting three days ago, Russ Housley provided
alternative text for 4.8.1, regarding PMK sharing issue. Here is the new
text from Russ:

 "  If the STA and AC are the parties in the 4-way handshake (defined in
   [4]), and 802.11i traffic encryption terminates at the WTP, then the
   PTK (Pairwise Transient Key) has to be transferred from the AC to the
   WTP.  Since the keying material is part of the control and
   provisioning of the WTPs, a secure encrypted tunnel for control
   frames is employed to transport the keying material.

   The centralized model encourages AC implementations to use one PMK
   for many different WTPs.  This practice facilitates speedy transition
   by a station from one WTP to another WTP that is connected to the
   same AC without establishing a separate PMK.  However, this leaves
   the station in a difficult position.  The station cannot distinguish
   between a compromised PMK and one that is intentionally being shared.
   This issue must be resolved.  While the resolution is beyond the
   scope of the CAPWAP working group; however, the resolution must be
   completed before the CAPWAP working group can complete its protocol
   development.  The venue for this resolution is to be determined by
   the  IEEE 802 and IETF liaisons."

A new version of the taxonomy draft which incorporated this new text is
available at http://www.capwap.org/draft-ietf-capwap-arch-06.txt
Please review by next Wed (Nov 17) as I would like to submit this draft
to IETF repository on Thursday for IESG review again.

Thanks!

Lily
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: "Yang, Lily L" <[email-masked]>
Date: Fri, 12 Nov 2004 07:36:45 -0800

Russ -- Does it have to be a strict dependency on this external unknown
entity? Is it acceptable if CAPWAP works around the problem before the
solution to the root of the problem is fixed somewhere else? In that
case, CAPWAP may not have to wait for the final solution coming from an
external entity, as long as CAPWAP also allows integration of such a
final solution.
It is best if we can structure it so that we can make progress at CAPWAP
without being subject to external dependency like this.

Bottom line: we need to fix the problem -- either by a permanent fix
coming from outside, or a temporary workaround. IMHO, both should be
acceptable. 

Lily

-----Original Message-----
From: Russ Housley [mailto:[email-masked]] 
Sent: Friday, November 12, 2004 7:24 AM
To: Bob O'Hara; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review

Bob:

How do we tell the reader about the dependency?  I am certainly willing
to 
accept any words that do so.

Russ

At 10:15 AM 11/12/2004, Bob O'Hara wrote:
>Lily,
>
>I disagree with the statement near the end of Russ' text that "the
>resolution must be completed before the CAPWAP working group can
>complete its protocol development."  This is one person's opinion.  My
>opinion is that, since Russ also grants that the solution to this
>problem is outside the scope of CAPWAP, all that CAPWAP has to do is
not
>to develop a protocol that prevents the problem from being solved.
>
>I also don't see how this statement of opinion belongs in the taxonomy
>document.  The description of the problem and the way it is dealt with
>by the centralized architecture belong in the document, but not the
>opinion.
>
>  -Bob
>
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On
>Behalf Of Yang, Lily L
>Sent: Friday, November 12, 2004 7:04 AM
>To: [email-masked]
>Cc: Russ Housley; Walker, Jesse
>Subject: [Capwap] Taxonomy v06 ready for review
>
>
>Hi,

---

From: "Bob O'Hara" <[email-masked]>
Date: Fri, 12 Nov 2004 08:07:58 -0800

Russ, 

I think that stating the problem, as you have so eloquently done, is
sufficient for the taxonomy draft, along with stating that it is not
solved.  The Objectives draft should include an objective of the to be
developed protocol(s) that the solution to the problem must not be
excluded by the protocol that is developed.  

The protocol document should have a restatement of the problem and a
description of what limitations, if any, the protocol places on how the
problem might be solved.  Possibly, the protocol document will reference
another document where the solution to the problem is described.

Does that make sense?

 -Bob

-----Original Message-----
From: Russ Housley [mailto:[email-masked]] 
Sent: Friday, November 12, 2004 7:24 AM
To: Bob O'Hara; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review

Bob:

Russ

not

---

From: "Pat R. Calhoun" <[email-masked]>
Date: Fri, 12 Nov 2004 08:43:39 -0800

Perhaps we can address this in the objectives by stating that the
protocol must be capable of handling whatever the outcome is. Basically,
by pushing this functinality into the AC, it becomes transparent to the
WTP and then becomes purely an implementation detail on the AC.

PatC 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Bob O'Hara
Sent: Friday, November 12, 2004 8:08 AM
To: Russ Housley; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review

Russ, 

Does that make sense?

 -Bob

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Friday, November 12, 2004 7:24 AM
To: Bob O'Hara; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review

Bob:

Russ

not

---

From: "Mani, Mahalingam (Mahalingam)" <[email-masked]>
Date: Fri, 12 Nov 2004 09:51:18 -0700

I tend to agree with Dorothy's suggestion on the stipulation being
called out in Objectives draft (inasmuch as there is now going to be
one) rather than in a taxonomy draft which has discovered the problem
but does not do anything by stipulating how protocol should be developed
- being informational document.

However, the text can be suggestive of the need to resolve this to
remove a hurdle when a protocol development happens.

I think that is as well the sentiment of Russ (though I will let him
confirm that) - that it not slip through the cracks - though it is too
significant an issue for such a thing to happen.

-mani
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Dorothy Stanley
Sent: Friday, November 12, 2004 8:38 AM
To: Bob O'Hara; Yang, Lily L; Russ Housley
Cc: [email-masked]; Walker, Jesse
Subject: Re: [Capwap] Taxonomy v06 ready for review

(a) Is the taxonomy draft the right place to be discussing dependencies
of the capwap protocol/workplan? The objectives draft currently being 
developed
seems to be a more appropriate place, since that is where the protocol
objectives/requirements and presumably any dependencies will be
discussed.

So I'd suggest leaving just the description of the situation in the 
taxonomy draft,
and including a statement of dependencies (if any) in the objectives
draft.

(b) Is a dependency required, and what is the nature of the dependency?
That is, must a method be identified to enable a station to
distinguish between a compromised PMK and one that is intentionally 
being shared, prior to
completion of the CAPWAP protocol? Must the method be standardized?
Right now, the CAPWAP milestones show a first draft of the CAPWAP 
protocol to be avalable Oct 05, with
completion in March of 06.  While having a standardized method in 
parallel is desirable, to be sure,
it introduces a schedule dependency. Is it sufficient to have a method 
identified and
in the process of being standardized, together with credible evidence 
that the proposed CAPWAP
protocol does not prevent the proposed solution?

Dorothy

not

-- 
----------------
Dorothy Stanley
Agere Systems
2000 North Naperville Rd. 
Naperville, IL 60566
630-979-1572 (Phone, Fax)
630-222-6753 (Cell)

---

From: "Sadot, Emek (Emek)" <[email-masked]>
Date: Fri, 12 Nov 2004 12:38:04 -0500

Lily, Russ,

Sharing/caching PMK method can span across multiple ACs in the same BESS
and still offers faster transaction from one WTP to another.

Suggest rewording: 'This practice facilitates speedy transition by a
station from one WTP to another WTP that is connected to the same or
different AC in the same ESS without establishing a separate PMK'

Emek

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Yang, Lily L
Sent: Friday, November 12, 2004 10:04 AM
To: [email-masked]
Cc: Russ Housley; Walker, Jesse
Subject: [Capwap] Taxonomy v06 ready for review

Hi, 

Thanks!

Lily

---

From: "Bob O'Hara" <[email-masked]>
Date: Mon, 15 Nov 2004 09:28:36 -0800

Russ,

I like it.  We will need to make sure that the issue moves forward to
the objectives draft and, ultimately, to the protocol draft(s).

 -Bob

-----Original Message-----
From: Russ Housley [mailto:[email-masked]] 
Sent: Monday, November 15, 2004 10:31 AM
To: Bob O'Hara; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review

Bob:

This makes sense to me.  How about replacing the paragraph with:

    The centralized model encourages AC implementations to use one PMK
    for many different WTPs.  This practice facilitates speedy
transition
    by a station from one WTP to another WTP that is connected to the
    same AC without establishing a separate PMK.  However, this leaves
    the station in a difficult position.  The station cannot distinguish
    between a compromised PMK and one that is intentionally being
shared.
    This issue must be resolved, but the resolution is beyond the scope
of
    the CAPWAP working group.  The venue for this resolution is to be
    determined by the  IEEE 802 and IETF liaisons.

Russ

At 11:07 AM 11/12/2004, Bob O'Hara wrote:
> >  "  If the STA and AC are the parties in the 4-way handshake
(defined
>in

---

From: "Pat R. Calhoun" <[email-masked]>
Date: Mon, 15 Nov 2004 14:43:21 -0800

I like the new text as well

PatC

-----Original Message-----
From: [email-masked] on behalf of Bob O'Hara
Sent: Mon 11/15/2004 9:28 AM
To: Russ Housley; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review
 
Russ,

 -Bob

-----Original Message-----
From: Russ Housley [mailto:[email-masked]] 
Sent: Monday, November 15, 2004 10:31 AM
To: Bob O'Hara; Yang, Lily L; [email-masked]
Cc: Walker, Jesse
Subject: RE: [Capwap] Taxonomy v06 ready for review

Bob:

Russ

(defined