Subject: Re: [Capwap] Response to LWAPP Security Review

From: "Agcaoili, Philip" <[email-masked]>
Date: Fri, 13 May 2005 19:34:14 -0400

So to summarize, you appear to be saying that LWAPP security depends from
implementation to implementation of the draft.

I'd like to be the voice of reason here and ask as a customer that the IETF
specification is explicit enough to reasonably ensure that every
implementation of the spec is secure.

Thanks,

Philip Agcaoili 
Chief Security Architect 
Enterprise Information Protection 
Scientific-Atlanta, Inc. 

     - - - - - - -  Appended by Scientific-Atlanta, Inc.  - - - - - - -  
This e-mail and any attachments may contain information which is confidential, proprietary, privileged or otherwise protected by law. The information is solely intended for the named addressee (or a person responsible for delivering it to the addressee). If you are not the intended recipient of this message, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately by return e-mail and delete it from your computer.

---

From: Charles Clancy <[email-masked]>
Date: Fri, 13 May 2005 22:07:01 -0400 (EDT)

In the current draft, there is some ambiguity on how 802.11 roaming should 
be implemented with respect to the 11i TSK.  The draft defines all the 
messages to be passed back and forth, but not how these affect the policy 
and state on the WTP and AC as they interact with 802.11i.  The most 
direct way to implement the protocol could yield a system vunerable to 
denial of service attacks.

As the Pat stated, they plan to address this problem by adding text 
clarifying this process.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

> This e-mail and any attachments may contain information which is confidential, proprietary, privileged or otherwise protected by law. The information is solely intended for the named addressee (or…
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: "Pat Calhoun" <[email-masked]>
Date: Fri, 13 May 2005 21:12:07 -0700

Actually, I agree, and the issues raised in the review state that the
specification needs to have clarifying text to ensure that other
implementations do things right. As I mentioned below, we will be adding
such text to ensure that the document is very clear, minimizing the
possibility of 3rd party implementors being vulnerable to the issues
mentioned.
 
Your voice is heard.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Agcaoili, Philip
Sent: Friday, May 13, 2005 4:34 PM
To: [email-masked]'
Subject: Re: [Capwap] Response to LWAPP Security Review

Thanks, 

Philip Agcaoili 
Chief Security Architect 

- - - - - - - Appended by Scientific-Atlanta, Inc. - - - - - - - 
This e-mail and any attachments may contain information which is
confidential, proprietary, privileged or otherwise protected by law. The
information is solely intended for the named addressee (or a person
responsible for delivering it to the addressee). If you are not the intended
recipient of this message, you are not authorized to read, print, retain,
copy or disseminate this message or any part of it. If you have received
this e-mail in error, please notify the sender immediately by return e-mail
and delete it from your computer.