Subject: RE: [Capwap] Important: please provide input on comment resolution for CAPWAP Taxonomy draft

From: "Pat R. Calhoun" <[email-masked]>
Date: Mon, 25 Oct 2004 11:19:23 -0700

That's a topic that I will not bother polluting this specific list with.
However, regardless of the end solution, I do believe that what we are
both agreeing to is that the CAPWAP architecture makes this solution
possible once the actual problem has been addressed.

PatC 

-----Original Message-----
From: Walker, Jesse [mailto:[email-masked]] 
Sent: Monday, October 25, 2004 10:48 AM
To: Pat R. Calhoun; Russ Housley
Cc: Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment
resolution for CAPWAP Taxonomy draft

Pat,

Your assertion that 802.11r is addressing the problem is not obviously
correct. Any solution that works will involve interaction between the
client, the AP or AC, and the AAA server. This is because the AAA server
is the only party available that the client trusts to make assertions
about its relationship with the Authenticator. This unfortunately means
that the solution is outside the scope of 802.11 and can only be dealt
with in IETF.

I think 802.11r can specify its requirements for solutions to this
problem, or it can draft the kind of solution it would like to see and
then request that the IETF accept its proposed solution as a work item.
I do not believe 802.11r can define the solution itself.

-- Jesse

-----Original Message-----
From: Pat R. Calhoun [mailto:[email-masked]]
Sent: Monday, October 25, 2004 10:40 AM
To: Russ Housley
Cc: Walker, Jesse; Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment
resolution for CAPWAP Taxonomy draft

Correct, and 802.11r is looking at that problem. The CAPWAP architecture
"enables" 802.11r to function.

PatC 

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Monday, October 25, 2004 10:32 AM
To: Pat R. Calhoun
Cc: Walker, Jesse; Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment
resolution for CAPWAP Taxonomy draft

Pat:

You are correct.  In the CAPWAP environment, the PMK is shared with many
WTPs.  However, the STA has no way to figure out which WTPs out to have
access to the PMK.  This needs to be solved before the PMK can be
effectively shared.

Russ

At 01:19 PM 10/25/2004, Pat R. Calhoun wrote:
>While I understand Jesse's point, the IEEE is looking at alternatives 
>in its 802.11r task group. So while there is no standards based 
>solution today, I think it would be a mistake to break future
interoperability.
>
>Furthermore, I think the point that Dan was trying to make was that in 
>the CAPWAP architecture, the AC contain the authenticator, not the WTP.
>Since the AC has access to the PMK, it is inherently a "shared" 
>resource
>- regardless of whether it is re-used across BSSIDs or not.
>
>PatC
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Yang, Lily L
>Sent: Monday, October 25, 2004 9:38 AM
>To: [email-masked]
>Cc: Walker, Jesse; [email-masked]
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>Another response from Jesse on this ...
>
>-----Original Message-----
>From: Walker, Jesse
>Sent: Saturday, October 23, 2004 7:06 PM
>To: Yang, Lily L; [email-masked]'
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>Whether vendors want to believe it or not, the BSSID of the AP 
>identifies the PMK the STA should use, while the PMKID was an 
>after-thought to 802.11i, and was not properly integrated to perform 
>the function required of it. In particular, the binding of BSSIDs and 
>STA MAC addresses to the PMKID was never undertaken. Therefore, if the 
>BSSID changes, the STA has to assume that the PMK has been compromised,

>unless the AAA server gives it some reason to believe the new BSSID is 
>also bound to the same PMK.
>
>-----Original Message-----
>From: Yang, Lily L
>Sent: Friday, October 22, 2004 12:59 PM
>To: Walker, Jesse; [email-masked]
>Subject: FW: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>Here is some other responds to the comment.
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Michael Montemurro
>Sent: Thursday, October 21, 2004 8:12 AM
>To: 'Pat R. Calhoun'; 'Chunduru Rama Krishna Prasad'; 
>[email-masked]
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>I'd agree that the text should likely remain. However, there should be 
>work done (likely in both IEEE and IETF) to modify the key hierarchy to

>address this case.
>
>         Mike
>
>-----Original Message-----
>From: Pat R. Calhoun [mailto:[email-masked]]
>Sent: Thursday, October 21, 2004 10:47 AM
>To: Michael Montemurro; Chunduru Rama Krishna Prasad; 
>[email-masked]
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>
>The comment may be valid in light of 802.11r. I'd argue that the text 
>remains since we need to be cognizant of not only current IEEE 
>standards, but also the ones in progress.
>
>PatC
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Chunduru Rama Krishna Prasad
>Sent: Thursday, October 21, 2004 5:27 AM
>To: [email-masked]
>Subject: Re: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>
>hi all,
>
>I am not sure, I am right on this. My impression is that, PMK is on per

>Authenticator MAC address. If the station is re-associated with new WTP

>(different MAC address), then it would not even send PMKID of old AP. 
>If there is no PMKID found in reassoc event, AC would start with full 
>802.1x authentication. If the station is reassociating with an AP, to 
>which it already established PMK before, then station sends PMKID and 
>in that case only 4 way key handshake is requried to get the PTK. With 
>respect to this, I am not sure whether the statement 'If PMK is shared 
>across multiple WTP' is valid. If not, the whole statement can be 
>removed from the draft
>
>Regards
>Rama Krishna Prasad
>
>
>
>Ch. Rama Krishna Prasad
>Intoto Software(I) Pvt Ltd,
>Uma Plaza, Nagarjuna circle,
>Panjagutta. Hyderabad, AP
>Tel No:s  2335 8927/8928/8434
>
>_______________________________________________
>Capwap mailing list
>[email-masked] http://mail.frascone.com/mailman/listinfo/capwap
>
>_______________________________________________
>Capwap mailing list
>[email-masked] http://mail.frascone.com/mailman/listinfo/capwap
>
>_______________________________________________
>Capwap mailing list
>[email-masked]
>http://mail.frascone.com/mailman/listinfo/capwap
>_______________________________________________
>Capwap mailing list
>[email-masked]
>http://mail.frascone.com/mailman/listinfo/capwap

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: "James Kempf" <[email-masked]>
Date: Mon, 25 Oct 2004 13:07:22 -0700

Pat,

From an architectural standpoint, the AAA server is the only functional
entity in the network that everybody trusts, so it has to be an important
part of the solution somehow. Since AAA is an IETF function, the IETF has to
be involved, and actually is probably the better body to do the technical
work, since the technical expertiese is in IETF.

Exactly how that plays out with 802.11r/CAPWAP, I am not sure, primarily
because I don't have a very good idea about what 802.11r does (and, after
spending a frustrating 10 minutes browsing around the confusing 802.11 Web
site and failing to find the PAR, I've not been able to find out by myself
either). If .11r is primarily concerned with host to network protocol, then
I think CAPWAP might be a good place to do the work in IETF, or the AAA WG
(though I believe they are on the verge of closing). If .11r is involved in
network to network, then I am not so sure, it would depend on what .11r is
intending.

Perhaps the right time to discuss this is when .11r gets its requirements
together, but I do think it will need to be discussed in IETF at some point.

            jak

----- Original Message ----- 
From: "Pat R. Calhoun" <[email-masked]>
To: "Walker, Jesse" <[email-masked]>; "Russ Housley"
<[email-masked]>
Cc: "Yang, Lily L" <[email-masked]>; <[email-masked]>
Sent: Monday, October 25, 2004 11:19 AM
Subject: RE: [Capwap] Important: please provide input on comment resolution
for CAPWAP Taxonomy draft

PatC

-----Original Message-----
From: Walker, Jesse [mailto:[email-masked]]
Sent: Monday, October 25, 2004 10:48 AM
To: Pat R. Calhoun; Russ Housley
Cc: Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment

Pat,

-- Jesse

-----Original Message-----
From: Pat R. Calhoun [mailto:[email-masked]]
Sent: Monday, October 25, 2004 10:40 AM
To: Russ Housley
Cc: Walker, Jesse; Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment

PatC

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Monday, October 25, 2004 10:32 AM
To: Pat R. Calhoun
Cc: Walker, Jesse; Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment

Pat:

Russ

interoperability.