CAPWAP Security 65 th IETF 20 March 2006 Scott Kelly

20 March 2006CAPWAP Working Group2 Why is security important in CAPWAP? Many interdependent security protocols running between the station and the network CAPWAP exposes some of this by breaking the original AP model into two pieces (AC/WTP) This architectural change must not degrade existing security (can’t create a weak link)

20 March 2006CAPWAP Working Group3 Threats Multiple deployment models –Direct L2 connection –Routed connection, one administrative domain –Routed connection, potentially hostile hops Direct L2 connection –Largely a physical security problem Routed connection (L3), same administrative domain –Seems similar to L2 at first glance –But gets interesting due to what the CAT5 dragged home –Mobile systems invalidate many assumptions regarding security of local LAN (soft and chewy inside is now exposed)

20 March 2006CAPWAP Working Group4 Threats, cont. Routed connection over potentially hostile hops –Remote WTP scenarios Employees take WTPs home Branch office WTP, Central office AC Hotspots some hops may be over wireless –Mesh (e.g. metro wifi)

20 March 2006CAPWAP Working Group5 How do we address these threats? When physical security is only concern, fairly simple When L3 within one admin domain, can mitigate various threats with switching, vlans, admission control, etc –But capwap should not impose requirements here When routed over potentially hostile hops, all bets are off CAPWAP protocol must be secure in any of these scenarios One common solution is preferable

20 March 2006CAPWAP Working Group6 DTLS vs Native LWAPP Security This is the invent vs. reuse debate we’ve had before in the IETF Even really smart people make mistakes –PPP (PAP, CHAP, etc) –RADIUS –WEP and other early WLAN security protocols –Several over-the-network password hashes –Finding more examples is left as an exercise to the reader Security, cryptography are very subtle –More than just combining primitives Ongoing broad technical review is critical –SSL/SSH improvements –Md5, sha1 cracks… Using a CAPWAP one-off will not invite this sort of attention Better to use something already reviewed which has broader deployment, and which will continue to attract attention

20 March 2006CAPWAP Working Group7 Where are we now? DTLS has been added to 00 draft The lwapp-dtls draft was in revision when 00 came due –Dtls insertion is rough –There are state machine issues Currently working to resolve various issues –Deletion of JOIN results in loss of important data –DTLS interaction with capwap state machine must be more fully specified At least two people are working on prototypes –Should rapidly uncover any integration issues We should consider a design team to speed the integration process –Goal should be to close all open integration issues asap –Interim meeting(s) if necessary

Questions?