Subject: [Capwap] LWAPP Security Review

From: "T. Charles Clancy" <[email-masked]>
Date: Thu, 12 May 2005 12:14:29 -0400 (EDT)

At the authors' request, I have completed a security review of LWAPP 
(http://www.ietf.org/internet-drafts/draft-ohara-capwap-lwapp-02.txt). 
The review can be found here:

http://www.cs.umd.edu/~clancy/docs/lwapp-review.pdf

Abstract:

This document introduces the LWAPP protocol and provides an analysis of 
its security features.  In particular, the public-key authentication, 
preshared-key authentication, and packet-level encryption are examined. 
Also, the security ramications introduced by the IEEE 802.11 binding are 
reviewed.  Lastly, recommendations on changes the the protocol are 
presented.

Overall, LWAPP is "secure". However, given access to the wired network, 
there are opportunities for denial of service attacks against the 
public-key authentication algorithm.  None of the attacks presented in 
this document result in the compromise of keying material for active 
sessions, or the ability to steal service.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: "Agcaoili, Philip" <[email-masked]>
Date: Thu, 12 May 2005 16:47:07 -0400

Is there a review of what has been done with the implementation that exists
in the field that are supposedly based off the base LWAPP draft?

Additionally, if the actual implementation in the field is not off the base
draft but this one, have they done a review based on the implementation of
this version of the spec?

Thanks,

Philip Agcaoili 
Chief Security Architect 
Enterprise Information Protection 
Scientific-Atlanta, Inc. 

     - - - - - - -  Appended by Scientific-Atlanta, Inc.  - - - - - - -  
This e-mail and any attachments may contain information which is confidential, proprietary, privileged or otherwise protected by law. The information is solely intended for the named addressee (or a person responsible for delivering it to the addressee). If you are not the intended recipient of this message, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately by return e-mail and delete it from your computer.

---

From: Michael Cheng <[email-masked]>
Date: Fri, 13 May 2005 12:31:09 +0100

We had a review on the early version of LWAPP in 2004 which can be found
via http://www.cs.mdx.ac.uk/staffpages/m_cheng/link/lwapp_g.pdf.

Abstract. Light Weight Access Point Protocol (LWAPP) is a new protocol
being
designed to make communications between access points and wireless
switches automatic. This protocol allows a router or switch to interop-
erably control and manage a collection of wireless access points, so as
to move some of the loading due to Wi-Fi processes and function com-
plexity to the centralized wireless switches or routers. In this report
we analyze the security design of the protocol, address some possible
attacks and present some fix solutions. Moreover the proposed key-
transport protocols have their own interest and can be used in other
scenarios.

--

We did not follow the development of LWAPP. But from Charles' work, we
found the 
public-key based scheme has not siginificant change in the new version. 
As Charles pointed out, the scheme is vulnerable to DoS attack.

Michael Cheng

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of T. Charles Clancy
Sent: Thursday, May 12, 2005 5:14 PM
To: [email-masked]
Cc: [email-masked]
Subject: [Capwap] LWAPP Security Review

Abstract:

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ] [
computer science ]-----[ university of maryland | college park ]
_______________________________________________
Capwap mailing list
[email-masked] http://mail.frascone.com/mailman/listinfo/capwap
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap