Subject: RE: [Capwap] PFS: requirement or not?

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 31 Mar 2006 13:31:36 -0800

> Why? Because WTP's will often be deployed in scenarios where 
> physical security is very difficult, if not impossible to 
> provide. That being the case, their credentials (i.e. the 
> long-term key referred to above) could be compromised at any 
> time, possibly without detection. If compromising this key 
> allows someone to decrypt previously recorded exchanges (and 
> future ones by simply recording them), this violates the 
> confidentiality requirement which led us to support 
> encryption to begin with.

Not that I'm in disagreement, but I question whether the process
required to gain access to the key is such that one could
just as easily gain access to the credentials - making the whole
point moot.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Charles Clancy <[email-masked]>
Date: Fri, 31 Mar 2006 17:23:53 -0500

In general, transient DTLS keys for past sessions would not be saved on 
the WTP.  Without PFS, if an attacker had saved the DTLS handshake from 
the previous session, they could use the compromised long-term key to 
derive past session keys, and therefore compromise past sessions. 
Therefore, in general, PFS is a good thing.

HOWEVER, what exactly are we trying to protect?  The whole point of DTLS 
is to prevent an attacker from compromising control traffic.  My 
question: What good is old control traffic to an attacker?  The only 
thing of value contained within is the PTK for 802.11i sessions that are 
no longer active.  Thus, my conclusion is that PFS is not a requirement.

I see no reason not to have PFS ciphersuites defined, but I don't think 
they should be mandatory to implement.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]