Subject: RE: [Capwap] Taxonomy v06 ready for review

From: "Bob O'Hara" <[email-masked]>
Date: Fri, 12 Nov 2004 07:15:43 -0800

Lily,

I disagree with the statement near the end of Russ' text that "the
resolution must be completed before the CAPWAP working group can
complete its protocol development."  This is one person's opinion.  My
opinion is that, since Russ also grants that the solution to this
problem is outside the scope of CAPWAP, all that CAPWAP has to do is not
to develop a protocol that prevents the problem from being solved.

I also don't see how this statement of opinion belongs in the taxonomy
document.  The description of the problem and the way it is dealt with
by the centralized architecture belong in the document, but not the
opinion.

 -Bob

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Yang, Lily L
Sent: Friday, November 12, 2004 7:04 AM
To: [email-masked]
Cc: Russ Housley; Walker, Jesse
Subject: [Capwap] Taxonomy v06 ready for review

Hi, 
At the IETF CAPWAP meeting three days ago, Russ Housley provided
alternative text for 4.8.1, regarding PMK sharing issue. Here is the new
text from Russ:

 "  If the STA and AC are the parties in the 4-way handshake (defined in
   [4]), and 802.11i traffic encryption terminates at the WTP, then the
   PTK (Pairwise Transient Key) has to be transferred from the AC to the
   WTP.  Since the keying material is part of the control and
   provisioning of the WTPs, a secure encrypted tunnel for control
   frames is employed to transport the keying material.

   The centralized model encourages AC implementations to use one PMK
   for many different WTPs.  This practice facilitates speedy transition
   by a station from one WTP to another WTP that is connected to the
   same AC without establishing a separate PMK.  However, this leaves
   the station in a difficult position.  The station cannot distinguish
   between a compromised PMK and one that is intentionally being shared.
   This issue must be resolved.  While the resolution is beyond the
   scope of the CAPWAP working group; however, the resolution must be
   completed before the CAPWAP working group can complete its protocol
   development.  The venue for this resolution is to be determined by
   the  IEEE 802 and IETF liaisons."

A new version of the taxonomy draft which incorporated this new text is
available at http://www.capwap.org/draft-ietf-capwap-arch-06.txt
Please review by next Wed (Nov 17) as I would like to submit this draft
to IETF repository on Thursday for IESG review again.

Thanks!

Lily
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: Dorothy Stanley <[email-masked]>
Date: Fri, 12 Nov 2004 10:37:50 -0600

(a) Is the taxonomy draft the right place to be discussing dependencies
of the capwap protocol/workplan? The objectives draft currently being 
developed
seems to be a more appropriate place, since that is where the protocol
objectives/requirements and presumably any dependencies will be discussed.

So I'd suggest leaving just the description of the situation in the 
taxonomy draft,
and including a statement of dependencies (if any) in the objectives draft.

(b) Is a dependency required, and what is the nature of the dependency?
That is, must a method be identified to enable a station to
distinguish between a compromised PMK and one that is intentionally 
being shared, prior to
completion of the CAPWAP protocol? Must the method be standardized?
Right now, the CAPWAP milestones show a first draft of the CAPWAP 
protocol to be avalable Oct 05, with
completion in March of 06.  While having a standardized method in 
parallel is desirable, to be sure,
it introduces a schedule dependency. Is it sufficient to have a method 
identified and
in the process of being standardized, together with credible evidence 
that the proposed CAPWAP
protocol does not prevent the proposed solution?

Dorothy

-- 
----------------
Dorothy Stanley
Agere Systems
2000 North Naperville Rd. 
Naperville, IL 60566
630-979-1572 (Phone, Fax)
630-222-6753 (Cell)