Subject: [Capwap] FW: More IETF Expert Review on rev-03...

From: "Mani, Mahalingam (Mahalingam)" <[email-masked]>
Date: Tue, 3 Aug 2004 10:08:42 -0600

The previous send has bounced - trying again.

-mani

  _____  

From: Mani, Mahalingam (Mahalingam) 
Sent: Monday, August 02, 2004 7:55 PM
To: [email-masked]; [email-masked]'
Subject: More IETF Expert Review on rev-03...

All,

Russ Housley's review comments are inline (embedded marked with a
leading [ on column 1) to the draft.

http://www.cs.ucla.edu/~pzerfos/draft-ietf-capwap-arch-03-comments.txt

(They will also be posted to www.capwap.org <http://www.capwap.org/>
website in due course).

Since -04 has been posted to WG (but not yet sent in as I-D) we can
anticipate another rev-05 to include addressing these.

Nevertheless,  do review -04 (and in the light of these comments as
well).

Regards,

-mani

---

From: "Pat R. Calhoun" <[email-masked]>
Date: Fri, 27 Aug 2004 11:36:42 -0700

My comments below.
 
PatC

________________________________

From: [email-masked] on behalf of Yang, Lily L
Sent: Wed 8/25/2004 3:53 PM
To: [email-masked]
Subject: RE: [Capwap] More IETF Expert Review on rev-03...

To address comment #5 below, the authors propose to replace the first paragraph in 4.8.1 with the following three paragraphs:

-------------- 

The survey shows clearly that the termination point for "over the 
air" 802.11 encryption (802.11i) can be implemented either in the WTP 
or in the AC.  Furthermore, the 802.1x/EAP functionality is also 
distributed between the WTP and the AC where, in almost all cases, 
the AC performs the necessary functions as the authenticator in the 
802.1x exchange.  

If the STA and AC are the parties in the 4-way handshake, and the encryption/decryption happens at the WTP, then the PTK has to be transferred from the AC to the WTP. If the PMK is reused across multiple WTPs, then requiring a 4-way handshake for each WTP that the station associates to, followed by the transfer of that PTK from the AC to the WTP, would ensure that a different PTK is used at each WTP.  Since the keying material is part of the control and provisioning of the WTPs, a secure encrypted tunnel for control frames is employed to transport the keying material.  

<PRC> Although the key exchange occurs between the supplicant and the authenticator (which is the AC), the supplicant has no way of knowing that multiple BSSIDs share a single authenticator. So this is not quite as simple as one would hope. This is also (in part) one of the tasks that the 802.11r Tg is looking at solving (I believe). I don't think this is a CAPWAP problem.

In the case where the 802.11i encryption/decryption is performed in the AC, the key exchange and state transitions occur between the AC and STA. Therefore, there is no need to transfer any crypto material between the AC and the WTP. 

<PRC> But there are cases were you need to encrypt close to the air, for instance to provide 802.11e.

PatC