Subject: RE: [Capwap] Important: please provide input on comment resolution for CAPWAP Taxonomy draft

From: "Pat R. Calhoun" <[email-masked]>
Date: Mon, 25 Oct 2004 10:40:09 -0700

Correct, and 802.11r is looking at that problem. The CAPWAP architecture
"enables" 802.11r to function.

PatC 

-----Original Message-----
From: Russ Housley [mailto:[email-masked]] 
Sent: Monday, October 25, 2004 10:32 AM
To: Pat R. Calhoun
Cc: Walker, Jesse; Yang, Lily L; [email-masked]
Subject: RE: [Capwap] Important: please provide input on comment
resolution for CAPWAP Taxonomy draft

Pat:

You are correct.  In the CAPWAP environment, the PMK is shared with many
WTPs.  However, the STA has no way to figure out which WTPs out to have
access to the PMK.  This needs to be solved before the PMK can be
effectively shared.

Russ

At 01:19 PM 10/25/2004, Pat R. Calhoun wrote:
>While I understand Jesse's point, the IEEE is looking at alternatives 
>in its 802.11r task group. So while there is no standards based 
>solution today, I think it would be a mistake to break future
interoperability.
>
>Furthermore, I think the point that Dan was trying to make was that in 
>the CAPWAP architecture, the AC contain the authenticator, not the WTP.
>Since the AC has access to the PMK, it is inherently a "shared" 
>resource
>- regardless of whether it is re-used across BSSIDs or not.
>
>PatC
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Yang, Lily L
>Sent: Monday, October 25, 2004 9:38 AM
>To: [email-masked]
>Cc: Walker, Jesse; [email-masked]
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>Another response from Jesse on this ...
>
>-----Original Message-----
>From: Walker, Jesse
>Sent: Saturday, October 23, 2004 7:06 PM
>To: Yang, Lily L; [email-masked]'
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>Whether vendors want to believe it or not, the BSSID of the AP 
>identifies the PMK the STA should use, while the PMKID was an 
>after-thought to 802.11i, and was not properly integrated to perform 
>the function required of it. In particular, the binding of BSSIDs and 
>STA MAC addresses to the PMKID was never undertaken. Therefore, if the 
>BSSID changes, the STA has to assume that the PMK has been compromised,

>unless the AAA server gives it some reason to believe the new BSSID is 
>also bound to the same PMK.
>
>-----Original Message-----
>From: Yang, Lily L
>Sent: Friday, October 22, 2004 12:59 PM
>To: Walker, Jesse; [email-masked]
>Subject: FW: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>Here is some other responds to the comment.
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Michael Montemurro
>Sent: Thursday, October 21, 2004 8:12 AM
>To: 'Pat R. Calhoun'; 'Chunduru Rama Krishna Prasad'; 
>[email-masked]
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>I'd agree that the text should likely remain. However, there should be 
>work done (likely in both IEEE and IETF) to modify the key hierarchy to

>address this case.
>
>         Mike
>
>-----Original Message-----
>From: Pat R. Calhoun [mailto:[email-masked]]
>Sent: Thursday, October 21, 2004 10:47 AM
>To: Michael Montemurro; Chunduru Rama Krishna Prasad; 
>[email-masked]
>Subject: RE: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>
>The comment may be valid in light of 802.11r. I'd argue that the text 
>remains since we need to be cognizant of not only current IEEE 
>standards, but also the ones in progress.
>
>PatC
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Chunduru Rama Krishna Prasad
>Sent: Thursday, October 21, 2004 5:27 AM
>To: [email-masked]
>Subject: Re: [Capwap] Important: please provide input on comment 
>resolution for CAPWAP Taxonomy draft
>
>
>hi all,
>
>I am not sure, I am right on this. My impression is that, PMK is on per

>Authenticator MAC address. If the station is re-associated with new WTP

>(different MAC address), then it would not even send PMKID of old AP. 
>If there is no PMKID found in reassoc event, AC would start with full 
>802.1x authentication. If the station is reassociating with an AP, to 
>which it already established PMK before, then station sends PMKID and 
>in that case only 4 way key handshake is requried to get the PTK. With 
>respect to this, I am not sure whether the statement 'If PMK is shared 
>across multiple WTP' is valid. If not, the whole statement can be 
>removed from the draft
>
>Regards
>Rama Krishna Prasad
>
>
>
>Ch. Rama Krishna Prasad
>Intoto Software(I) Pvt Ltd,
>Uma Plaza, Nagarjuna circle,
>Panjagutta. Hyderabad, AP
>Tel No:s  2335 8927/8928/8434
>
>_______________________________________________
>Capwap mailing list
>[email-masked] http://mail.frascone.com/mailman/listinfo/capwap
>
>_______________________________________________
>Capwap mailing list
>[email-masked] http://mail.frascone.com/mailman/listinfo/capwap
>
>_______________________________________________
>Capwap mailing list
>[email-masked]
>http://mail.frascone.com/mailman/listinfo/capwap
>_______________________________________________
>Capwap mailing list
>[email-masked]
>http://mail.frascone.com/mailman/listinfo/capwap

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: Clint Chaplin <[email-masked]>
Date: Mon, 25 Oct 2004 10:57:51 -0700

"The CAPWAP architecture "enables" 802.11r to function."  Say what?

Number one, I didn't think there was a CAPWAP "architecture"; well, at
least this group hasn't been able to define one.  CAPWAP is more a
protocol....

And, number two, the above seems to imply that without CAPWAP, IEEE
802.11r wouldn't be able to solve the problem at all.  I find that
limiting.

-- 
Clint (JOATMON) Chaplin
Wireless Security Technologist
Wireless Standards Lead
_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: Dan Harkins <[email-masked]>
Date: Mon, 25 Oct 2004 13:34:49 -0700

On Mon, 25 Oct 2004 10:57:51 PDT you wrote
> least this group hasn't been able to define one.  CAPWAP is more a

  Whoa, whoa, whoa! 

  CAPWAP is a taxonomy. And maybe it can become an "architecture". We
shall see. But what CAPWAP is definitely not (in spite of some laughable
press releases to the contrary) is a protocol. It might become one
some day, but it is not one now.

  Dan.