Subject: RE: [Capwap] security in objectives draft

From: "Clint Chaplin" <[email-masked]>
Date: Tue, 17 May 2005 18:17:16 -0700

"antiquated marketing requirements" are not the only reason for this position.  Low cost/low power terminals, especially legacy devices, currently are deployed in the industry, and need WEP support in the infrastructure.

Laptops are not the only portable/mobile devices to use 802.11, although it has by far the greatest mindshare withing various standards bodies in this space.  Small industrial handheld terminals are a viable market.

Besides, whatever protocol CAPWAP settles upon should be completely agnostic to the security policy being used over the air.

Clint (JOATMON) Chaplin
Wireless Security Advisor
Wireless Standards Manager
>>> Matt Holdrege <[email-masked]> 05/17/05 17:26 PM >>>
At 01:26 PM 5/17/2005, Pat Calhoun wrote:
> > With all due respect to the installed base of WEP-only gear,
> > the IETF should absolutely not make any exception in this or
> > any other similar case.
> > The legacy installed base has nothing to do with future IETF
> > protocols, especially when it weakens security. Just because
> > the CAPWAP protocol may be used by these legacy AP's, doesn't
> > mean that they have to be forklift upgraded. What it means is
> > that they will not fully comply with the security portion of
> > the specification. Anyone doing a security audit of such a
> > network would reject any WEP-only gear in any case.
> >
> > Think if we had rejected IPsec because the massive installed
> > base of Windows 3.1 intel-386 PC's couldn't comply with it.
>Matt, while I understand your concerns here, I don't agree that
>the IETF is in a position to tell AP vendors what security schemes
>they can and cannot support. In fact, as of today, not supporting
>WTP would mean that the vendor would lose their ability for
>WiFi certification.
>
>
>Pat Calhoun
>CTO, Wireless Networking Business Unit
>Cisco Systems

First of all the IETF tells all vendors of all products what they MUST and 
MUST NOT support to comply with an RFC. AP vendors are no different from 
anyone else and AP vendors already support lots of MUST's in other RFC's. 
Secondly, I don't think the WiFi Alliance has anything like a normative 
reference to any RFC's right? The WiFi alliance can insert into their 
documents whatever they want and they can say that "even though the IETF 
CAPWAP RFC says no to WEP, we will allow it for our certification tests."

My concern is the integrity of the IETF and RFC's. We shouldn't stoop to 
antiquated marketing requirements, especially where security is concerned.

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

________________________________________________________________________
This email has been scanned for computer viruses.

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: Matt Holdrege <[email-masked]>
Date: Tue, 17 May 2005 21:42:19 -0700

WEP does not equal security. We should not only refrain from advocating 
WEP, we must use whatever communication powers we have to advise people to 
NOT USE WEP. Low power is no excuse for deceiving people. I agree that 
small terminals are a big part of the market, especially voice handsets. 
But voice handsets already support 802.11i (announced recently) and voice 
terminals have severe power restrictions. Yet at a recent conference a chip 
manufacturer said their small remote terminal reference implementation 
supported high security with 100 hours of battery time. So there is no 
excuse for not demanding reasonable security in wireless. At least TKIP or 
AES encryption should be a minimum for all currently shipping and future 
802.11 products. Anything less is borderline fraudulent since we know 
anything less is easily cracked.

As for CAPWAP being agnostic to the air security, that is a good argument. 
But we have requirements to control the air security so we do have to 
address it.

-Matt

At 06:17 PM 5/17/2005, Clint Chaplin wrote:
>"antiquated marketing requirements" are not the only reason for this 
>position.  Low cost/low power terminals, especially legacy devices, 
>currently are deployed in the industry, and need WEP support in the 
>infrastructure.
>
>Laptops are not the only portable/mobile devices to use 802.11, although 
>it has by far the greatest mindshare withing various standards bodies in 
>this space.  Small industrial handheld terminals are a viable market.
>
>Besides, whatever protocol CAPWAP settles upon should be completely 
>agnostic to the security policy being used over the air.
>
>Clint (JOATMON) Chaplin

---

From: Charles Clancy <[email-masked]>
Date: Wed, 18 May 2005 09:42:53 -0400 (EDT)

So... it sounds like the rough consensus (compromise?) is that CAPWAP 
shouldn't advocate the use of WEP, but it's not necessarily our business 
to say people can't use it.  My proposed text for the objectives draft 
will essentially say what I said in the first place -- that we should 
normatively recommend that WEP not be used.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

On Tue, 17 May 2005, Matt Holdrege wrote:

> WEP does not equal security. We should not only refrain from advocating WEP, 
> we must use whatever communication powers we have to advise people to NOT USE 
> WEP. Low power is no excuse for deceiving people. I agree that small 
> terminals are a big part of the market, especially voice handsets. But voice 
> handsets already support 802.11i (announced recently) and voice terminals 
> have severe power restrictions. Yet at a recent conference a chip 
> supported high security with 100 hours of battery time. So there is no excuse 
> for not demanding reasonable security in wireless. At least TKIP or AES 
> encryption should be a minimum for all currently shipping and future 802.11 
> products. Anything less is borderline fraudulent since we know anything less 
> is easily cracked.
>
> But we have requirements to control the air security so we do have to address 
> it.
>
> -Matt
>