November 2005

IEEE 802.11 WG

Slide 1

doc: IEEE 802.11-05/0967r9

Submission

WAPI Position Paper

2005-11-15

Notice: This document has been prepared to assist IEEE 802.11. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.

Release: The contributor grants a free, irrevocable license to the IEEE to incorporate material contained in this contribution, and any modifications thereof, in the creation of an IEEE Standards publication; to copyright in the IEEE’s name any IEEE Standards publication even though it may include portions of this contribution; and at the IEEE’s sole discretion to permit others to reproduce in whole or in part the resulting IEEE Standards publication. The contributor also acknowledges and accepts that this contribution may be made public by IEEE 802.11.

Patent Policy and Procedures: The contributor is familiar with the IEEE 802 Patent Policy and Procedures <http:// ieee802.org/guides/bylaws/sb-bylaws.pdf>, including the statement "IEEE standards may include the known use of patent(s), including patent applications, provided the IEEE receives assurance from the patent holder or applicant with respect to patents essential for compliance with both mandatory and optional portions of the standard." Early disclosure to the Working Group of patent information that might be relevant to the standard is essential to reduce the possibility for delays in the development process and increase the likelihood that the draft publication will be approved for publication. Please notify the Chair <stuart.kerry@philips.com> as early as possible, in written or electronic form, if patented technology (or technology under patent application) might be incorporated into a draft standard being developed within the IEEE 802.11 Working Group. If you have questions, contact the IEEE Patent Committee Administrator at <patcom@ieee.org>.

November 2005

IEEE 802.11 WG

Slide 2

doc: IEEE 802.11-05/0967r9

Submission

Discussion of the parallel fast track ballotsfor 802.11i and WAPI

Prepared for consideration by JTC1 P-members

15 November 2005

November 2005

IEEE 802.11 WG

Slide 3

doc: IEEE 802.11-05/0967r9

Submission

Harmonisation is the most desirable outcome, and approval of WAPI will preclude harmonisation

Summary

What is the history?

• WAPI is a WLAN security amendment to 802.11 that has been promoted by the Chinese NB as an alternative to 802.11i

• WAPI became a topic of controversy in the WLAN industry in 2003, but the issue was postponed after a high level government agreement in 2004

What is the current situation?

• The “WAPI issue” resurfaced in JTC1 in 2004, resulting in parallel fast track ballots for both WAPI & 802.11i

• The parallel fast track ballots only started after the Chinese NB rejected all attempts to harmonise WAPI & 802.11i

• The parallel fast track ballots for WAPI & 802.11i allow for none, one, or both proposals to be approved

What should happen?

• Harmonisation is the most desirable outcome, and approval of WAPI will preclude harmonisation

November 2005

IEEE 802.11 WG

Slide 4

doc: IEEE 802.11-05/0967r9

Submission

WAPI is a security amendment to 802.11 promoted by the Chinese NB as an alternative to 802.11i

Summary – History

IEEE 802.11i Chinese NB WAPI

• Disclosed algorithms 802.1X & IETF EAP Multiple credentials

• Digital certificates only• Custom protocol (WAI),

undisclosed parameters

• Disclosed algorithms AES CCMP TKIP & legacy WEP

• Undisclosed blockcipher crypto

• RSN IE• WAPI IE

(clone of RSN IE)

Authentication mechanism

Block cipher

Advertisement & negotiation

• Amendment to ISO/IEC 8802-11Base

1N 7903 1N7904Document no.

November 2005

IEEE 802.11 WG

Slide 5

doc: IEEE 802.11-05/0967r9

Submission

WAPI became a topic of controversy in the WLAN industry in 2003, but the issue was postponed

• WAPI became subject of controversy in 2003 when a regulation was announced in China to require WAPI in all WLANs sold in China

• Most of WLAN industry and various governments opposed the WAPI regulation because:– It meant standard 802.11 equipment (without WAPI) could not be sold within

China, serving no justifiable or sound regulatory need & erecting unnecessary trade barriers

– Access to the secret WAPI block cipher required a technical partnership with government selected Chinese companies, resulting in IPR and business risks

• The WAPI controversy subsided in early 2004 after the Chinese government agreed to postpone promulgation of the regulation indefinitely– Due to legitimate concerns about hampering global trade in WLAN equipment,

intervention on WAPI occurred at the highest levels of the US and Chinese governments, with Vice Premier Wu Yi (China) and Secretary of State Colin Powell (US) involved

Summary – History

November 2005

IEEE 802.11 WG

Slide 6

doc: IEEE 802.11-05/0967r9

Submission

The “WAPI issue” resurfaced in JTC1 in 2004, resulting in parallel fast track ballots for WAPI & 802.11i

• In July 2004, the WAPI controversy was reignited when a new version of WAPI was submitted to JTC1 for standardisation by the Chinese NB

• In October 2004, IEEE 802.11i was submitted for fast track ballot in JTC1 by the UK NB

• Since that time, there has been much confusion and disagreement related to the correct processes for considering WAPI & 802.11i in JTC1– eg the Chinese NB incorrectly claims that WAPI was submitted to fast track

• The ISO/IEC Secretaries General have now decided (with support of the NBs) to attempt to resolve the controversy by sending both the WAPI & 802.11i proposed amendments to parallel fast track ballots in JTC1

Summary – Situation

November 2005

IEEE 802.11 WG

Slide 7

doc: IEEE 802.11-05/0967r9

Submission

The parallel fast track ballots started only after the Chinese NB rejected all attempts to harmonise

• ISO/IEC attempted to promote a process of harmonisation between 802.11i and WAPI, as well as the IEEE and the Chinese NB

• The IEEE actively supported the harmonisation activities by:– Participating in meetings with the Chinese NB in US (Nov 04), Germany (Feb

05), Switzerland (May 05), China (Aug 05) & France (Aug 05)

– Repeatedly inviting the Chinese NB to participate in 802.11 activities from the time of the first WAPI controversy

– Supporting the standardisation of WAPI technology in appropriate forums

– Attempting to hold an 802.11 meeting in Beijing in May 2005 (but was unable to obtain visas for delegates)

• However, the Chinese NB steadfastly rejected all attempts to harmonise 802.11i and WAPI by:– Walking out of the meeting in Germany (Feb 05)

– Repeatedly refusing to consider any approach except full approval of WAPI “as is,” regardless of its incompatibility with the existing 8802-11 standard and its emerging amendments Summary – Situation

November 2005

IEEE 802.11 WG

Slide 8

doc: IEEE 802.11-05/0967r9

Submission

The parallel fast track ballots for WAPI & 802.11i allow for none, one or both proposals to be approved

WAPI

802.11i

Yes

Yes

Yes

No

No

Yes

No

No

Parallel standards

WAPIonly

802.11ionly

Rejectboth

• Both 802.11i & WAPI are approved

• Parallel, independent and conflicting standards are inevitable if both are approved in fast track

• WAPI is standardised in JTC1

• 802.11i is standardised in JTC1

• Status quo, with no ISO/IEC security WLAN standard

Summary – Situation

Result

November 2005

IEEE 802.11 WG

Slide 9

doc: IEEE 802.11-05/0967r9

Submission

Parallel, independent and conflicting standards are inevitable if both are approved in fast track

It is claimed a “stapled” approach is viable if both

ballots are approved

The stapled approachis impossible

• One possible outcome of the fast track balloting process is that both 802.11i and WAPI are approved

• At the Beijing meeting in August 2005, the Chinese NB claimed the two amendments could be “stapled” into 8802-11 to create a new standard

• The editing instructions in 802.11i (1N7903) and WAPI (1N7904) are contradictory

• Execution of editing instructions from both proposals is impossible

• Comment resolution would most likely require years to resolve the editorial and normative technical issues – and so is not viable

Parallel standards is the only choice if both

ballots are approved

• The only way to avoid the issues related to the “stapled” approach is to create two parallel and independent standards covering WLANs

• Note: the suggestion that comment resolution could harmonise WAPI & 802.11i if both were approved is also not viable because the process is not set up for making big changes

Summary – Situation - Parallel

November 2005

IEEE 802.11 WG

Slide 10

doc: IEEE 802.11-05/0967r9

Submission

The editing instructions in 802.11i (1N7903) and WAPI (1N7904) are contradictory

WAPI

802.11i

Examples from clause 5.7.5 of both proposals showing editorial & normative differences

Summary – Situation – Parallel - Editing

November 2005

IEEE 802.11 WG

Slide 11

doc: IEEE 802.11-05/0967r9

Submission

Harmonisation is the most desirable outcome, and approval of WAPI will preclude harmonisation

WAPI

802.11i

Yes

Yes

Yes

No

No

Yes

No

No

Parallel standards

WAPIonly

802.11ionly

Rejectboth

• WAPI is generally unsuitable for approval in its current form

• Fails to meet WTO & ISO/IEC goals & resultsin ISO/IEC irrelevance in WLANs

• WAPI is generally unsuitable for approval in its current form

• Divorces ISO/IEC from 802.11 & results in ISO/IEC irrelevance in WLANs

• 802.11i should be approved, satisfying the needs of 100’s millions of existing users

• Encourages Chinese NB to participate in harmonisation process

• A no-no vote is not defensible on any technical grounds

• Acceptable only if the Chinese NB are willing to participate in harmonisation

UNACCEPTABLE UNACCEPTABLE DESIRABLE LESS DESIRABLESummary – Conclusion

Conclusion

November 2005

IEEE 802.11 WG

Slide 12

doc: IEEE 802.11-05/0967r9

Submission

WAPI is generally unsuitable for approvalby JTC1 in its current form

November 2005

IEEE 802.11 WG

Slide 13

doc: IEEE 802.11-05/0967r9

Submission

WAPI is generally unsuitable for approval by JTC1 in its current form

WAPI problems

WAPI is not suitable for approval via the fast track process

• WAPI is unstable and immature, making it unsuitable for consideration by fast track ballot

• Application of established “fast track” contradiction procedures should halt the WAPI fast track ballot

WAPI includes functions that are inappropriate in 8802-11

• WAPI digital certificates should be considered by JTC1/SC6/WG7 or ITU-T rather than JTC1/SC6/WG1

• WAPI authentication (WAI) should be considered by JTC1/SC27 rather than JTC1/SC6/WG1

November 2005

IEEE 802.11 WG

Slide 14

doc: IEEE 802.11-05/0967r9

Submission

WAPI is generally unsuitable for approval by JTC1 in its current form

WAPI problems

WAPI’s use of undisclosed ciphers doesn’t support standards goal of

interoperable security

• WAPI’s use of undisclosed or unspecified block ciphers means global interoperability is impossible

• WAPI’s use of undisclosed or unspecified block ciphers means users assume it provides no security

WAPI ignores clearly demonstrated market requirements

• WAPI imposes WAI rather than meeting the international market requirement for RADIUS based authentication

• WAPI ignores the needs of 200+ million existing 8802-11 compliant devices

November 2005

IEEE 802.11 WG

Slide 15

doc: IEEE 802.11-05/0967r9

Submission

WAPI is unstable and immature, making it unsuitable for consideration by fast track ballot

Fast track is designedfor mature & stable

“existing standards”

WAPI is unstable & immature

• The ISO/IEC JTC1 fast track process is designed to enable fast processing of an “existing standard”

• It is implicitly assumed that “existing standards” are stable and mature

• The WTO (G/TBT/9) outlines principles for standards development including transparency, openness & consensus

• The WAPI document has changed multiple times since 2003, with most recent change in August 2005

• It is unclear that WAPI was developed based on WTO principles for transparency, openness & consensus

• While the Chinese NB has the right to submit WAPI to fast track, it is not suitable given its immaturity and lack of stability

• WAPI should be removed from fast track or rejected by the ballot process

• WAPI should then be considered using normal ISO non-fast track processes

WAPI is not suitable for fast track review

WAPI problems – Immature

November 2005

IEEE 802.11 WG

Slide 16

doc: IEEE 802.11-05/0967r9

Submission

WAPI has changed substantially & radically multiple times, with most recent change in August 2005

Substantive & radical changes included:

• Changing the protection scheme:

– from MSDU based

– to MPDU based

• Introducing a discovery & negotiation scheme duplicated from 802.11i

Substantive changes included supporting:

• Broadcast & multicast, which is required by modern networking

• A security MIB

• Replay protection, which is a radical change with interesting subtleties

Chinese standardGB15629.11 (2003)

1N7506 6N12687

1N7904

May 2003 July 2004 August 2005

WAPI problems – Immature - Timeline

November 2005

IEEE 802.11 WG

Slide 17

doc: IEEE 802.11-05/0967r9

Submission

Application of established “fast track” contradiction procedures should halt the WAPI fast track ballot

ISO JTC1 has well established procedures

for “fast track”

Despite WAPI containing contradictions, they will

not be resolved

• “ISO/IEC JTC1 Directives” documents the JTC1 procedures for fast track

• They require that P-members review & comment on documents

• Any contradictions with other ISO or IEC standards must be resolved before ballot voting

• WAPI (1N7904) has multiple known “contradictions” with other standards

• However, those “contradictions” in WAPI will not be resolved before the five month ballot starts

• WAPI’s “contradictions” should be resolved according to JTC1 procedures before the five month ballot starts to avoid impinging on the rights and time of member NBs

WAPI contradictions must be resolved before

fast track progresses

WAPI problems – Fast track

November 2005

IEEE 802.11 WG

Slide 18

doc: IEEE 802.11-05/0967r9

Submission

WAPI has multiple known “contradictions” with other standards

8802-11

WAPI’s digital certificate contradicts the ITU-T

X.509 standard

WAPI’s authentication mechanism (WAI) does

not belong in SC6

• WAPI defines a new digital certificate

• Digital certificates are outside the established scope of JTC1/SC6/WG1

• Digital certificates have previously been defined by ITU-T in X.509 (also ISO/IEC Std 9594)

• The digital certificate work in WAPI is probably best considered by ITU-T

• WAPI defines a new authentication mechanism (WAI)

• Authentication mechanisms are outside the established scope of JTC1/SC6

• This work is probably best done in JTC1/SC27

• WAPI deletes WEP from 8802-11

• This change succeeds in making 200+ million devices instantly non-compliant with an existing ISO/IEC standard

WAPI deletion of WEP “contradicts” 8802-11

WAPI problems – Fast track – Contradictions

November 2005

IEEE 802.11 WG

Slide 19

doc: IEEE 802.11-05/0967r9

Submission

There is no plan for “contradictions” in WAPI to be resolved before the 5 month ballot starts

• China NB submitted a WAPI specification as a New Work Item Proposal (NP) to JTC1 in July 04– The entries for Proposer & Secretariat on the

NP form appear to have been transposed accidentally so that it appeared that SC 6 had submitted the proposal

• The JTC1 Secretariat issued WAPI (1N7506) as a concurrent ballot on the assumption that the SC6 Secretariat had already initiated a ballot in SC6

• However, it is believed that the NP was not submitted to the SC6 Secretariat

• When the JTC1 Secretariat realised the situation they voided 1N7506 and asked the China NB to submit the proposal to SC6

• 1N7506 was never subjected to a 30 day contradiction review

• However, the China NB did not submit a WAPI specification for fast track ballot until 25 Aug 05

• The WAPI specification submitted (1N7904) is radically different from any previous submission

• ISO/IEC Secretaries General ruled in a letter (6 Sept) that 1N7904 will progress to fast track, with a 30 day contradiction review and a 5 month ballot

• However, it was also ruled that the 5 month ballot will proceed regardless of any contradictions uncovered

• This is contrary to normal ISO JTC1 practice and process

WAPI problems – Fast track – No resolution

November 2005

IEEE 802.11 WG

Slide 20

doc: IEEE 802.11-05/0967r9

Submission

WAPI digital certificates should be considered by JTC1/SC6/WG7 or ITU-T rather than JTC1/SC6/WG1

WAPI defines adigital certificate

format

Digital certificates are outside the scope of

JTC1/SC6/WG1

• WAPI (1N7904) defines a novel digital certificate format in 8.1.3

• ISO/IEC JTC1/SC6 WG1’s scope is MAC & PHY standards, not digital certificate standards

• The digital certification formats are already co- standardized by:

– JTC1/SC6/WG7 (ISO/IEC Std 9594)

– ITU-T (ITU-T Std X.509)

• WAPI digital certificates have a wider application than WLANs

• WAPI digital certificates do not appear to support any functions that X.509 does not already provide

• Consideration of WAPI digital certificates should be moved to:

– JTC1/SC6/WG7

– ITU-T

The WAPI certificates should be submitted to

another forum

WAPI problems – Digital certificates

November 2005

IEEE 802.11 WG

Slide 21

doc: IEEE 802.11-05/0967r9

Submission

WAPI authentication (WAI) should be considered by JTC1/SC27 rather than JTC1/SC6/WG1

WAPI defines an authentication protocol

called WAI

Authentication is outside the scope of

JTC1/SC6/WG1

• WAPI defines a novel authentication methods (WAI) in clause 8.1.4.2

• ISO/IEC JTC1/SC6/WG1 developed and maintains 8802-11

• The scope of WG1 is “Physical and data link layers”

• Authentication standards as proposed by the WAPI submission are outside the scope of ISO/IEC JTC1/SC6/WG1

• WAI is easily applicable to many environments besides wireless LAN standards eg China’s NB has

signaled its intention to apply WAI to WiMAX

• JTC1/SC27 appears to be the appropriate standardization body for authentication methods

WAI should besubmitted toJTC1/SC27

WAPI problems - Authentication

November 2005

IEEE 802.11 WG

Slide 22

doc: IEEE 802.11-05/0967r9

Submission

WAPI’s use of undisclosed or unspecified block ciphers means global interoperability is impossible

WAPI uses a secretor a unspecified

block cipher

WAPI doesn’t enable global interoperability

• WAPI specifies the use of a block cipher within China called SMS4, which appears to be unavailable to non-Chinese parties

• WAPI suggests that another block cipher should be used in other countries, but does not specify the cipher

• It appears likely that non Chinese companies will be unable to implement WAPI based on SMS4

• WAPI based on SMS4 does not interoperate with WAPI based on any other block cipher

• The lack of at least one specified, globally available block cipher means global WAPI interoperability is impossible

• Interoperability in most countries is required by vendors, users & the standards community

• Either SMS4 must be disclosed or another disclosed block cipher must replace it

• Alternatively, WAPI should remain as a Chinese national standard rather than an international standard

WAPI must be modified to enable global interoperability

WAPI problems – Global interoperability

November 2005

IEEE 802.11 WG

Slide 23

doc: IEEE 802.11-05/0967r9

Submission

WAPI’s use of undisclosed or unspecified block ciphers means users assume it provides no security

WAPI uses undisclosed or unspecifiedblock ciphers

WAPI’s securitycannot be evaluated

• WAPI specifies the use of a block cipher within China called SMS4, which has not been publicly disclosed

• WAPI suggests that another block cipher should be used in other countries, but does not specify the cipher

• 100% of WAPI’s data security derives from the underlying block cipher

• It is impossible to independently evaluate WAPI’s security because no publicly disclosed block cipher is specified

• Without independent analysis, the market will assume that WAPI provides no security

WAPI must be modified to enable a proper

security review

• Unknown security is unacceptable to governments, vendors, users & the standards community

• Either SMS4 must be disclosed or another disclosed block cipher must replace it

• Alternatively, WAPI should remain as a Chinese national standard rather than an international standard

WAPI problems – No security

November 2005

IEEE 802.11 WG

Slide 24

doc: IEEE 802.11-05/0967r9

Submission

WAPI imposes WAI rather than meeting the international market requirement for RADIUS based authentication

WAPI specifies a single authentication method

called WAI

WAPI ignores the market requirement for RADIUS

based authentication

• WAPI (1N7904) requires the use WAI authentication

• In contrast, 802.11i supports RADIUS authentication

• WAI is incompatible with widely deployed RADIUS mechanisms, making WAI irrelevant to the majority of the market whom have an existing large RADIUS investment

• In contrast, 802.11i was designed to satisfy the demonstrated market need for WLANs to reuse existing RADIUS infrastructure

WAPI should be modified to recognise market

requirements for RADIUS

• WAI should be standardised as another authentication method available to the market

• In the meantime, WAPI should be modified to allow the use of RADIUS, as well as WAI

• This approach ensures WAPI satisfies the goal of standards to grow markets, not arbitrarily

restrict them

WAPI problems – Imposes WAI

November 2005

IEEE 802.11 WG

Slide 25

doc: IEEE 802.11-05/0967r9

Submission

WAPI ignores the needs of 200+ million existing 8802-11 compliant devices

Amendments must be compatible with existing

compliant devices

WAPI ignores the needs of 200+ million 8802-11

compliant devices

• It is a well accepted principle of standards development that amendments should continue to support existing compliant devices

• The 200+ million existing 8802-11 devices that cannot implement advanced security must be supported

• However, WAPI (1N7904) ignores the needs of these devices by:

– Deleting WEP

– Defining no suitable upgrade path

WAPI must be modified to recognise existing

8802-11 devices

• 802.11i (1N7903) provides an example of what WAPI must do before it begins to be acceptable:

– Deprecating rather than deleting WEP

– Defining an upgrade path using TKIP, which provides real security guarantees within the resource constraints of legacy technology

WAPI problems – Ignores existing

November 2005

IEEE 802.11 WG

Slide 26

doc: IEEE 802.11-05/0967r9

Submission

Parallel standards fail to meet WTO & ISO/IEC requirements and will result inISO/IEC irrelevance in WLANs

November 2005

IEEE 802.11 WG

Slide 27

doc: IEEE 802.11-05/0967r9

Submission

Parallel standards fail to meet WTO & ISO/IEC goals and will result in ISO/IEC irrelevance in WLANs

Parallel problems

Contrary toISO/IEC & WTO

Leads to ISO/IEC irrelevance

WAPI subject to IPR uncertainty

Approval of both WAPI & 802.11i in the fast

track ballot is contrary to ISO & WTO goals

The approval of both WAPI & 802.11i results in divorce from future

IEEE work and ISO/IEC irrelevance in WLANs

Any WAPI version of 8802-11 without IEEE support is subject to

severe “IPR uncertainty”

Approve one or neither of WAPI & 802.11i

Approve only802.11i

Approve only802.11i

WAPI is generally unsuitable for approvalby JTC1 in its current form

November 2005

IEEE 802.11 WG

Slide 28

doc: IEEE 802.11-05/0967r9

Submission

Approval by JTC1 of both WAPI & 802.11i in the fast track ballot is contrary to ISO/IEC & WTO goals

S

C

KL

Both WTO & ISO discourage duplicate

standards

Approval of 802.11i and WAPI is contrary toWTO and ISO goals

• The ISO Strategic Plan 2005-2010 clearly states one standard is preferable

• The WTO “Agreement On Technical Barriers To Trade” states that duplication of standards should be avoided

• The approval of both WAPI and 802.11i will result in two incompatible and non interoperable standards covering WLANs

Only one of 802.11i and WAPI should be

approved

• NB’s under WTO rules and ISO goals have a responsibility to approve only one of the proposals

Parallel problems – ISO/WTO goals

November 2005

IEEE 802.11 WG

Slide 29

doc: IEEE 802.11-05/0967r9

Submission

Both WTO & ISO discourage duplicate standards

ISO Strategic Plan 2005-2010

• “One standard, one test, and one conformity assessment procedure accepted everywhere”

WTO “Agreement On Technical Barriers To Trade”

• “The standardizing body within the territory of a Member shall make every effort to avoid duplication of, or overlap with, the work of other standardizing bodies in the national territory or with the work of relevant international or regional standardizing bodies”

Parallel problems – ISO/WTO goals - Quotes

November 2005

IEEE 802.11 WG

Slide 30

doc: IEEE 802.11-05/0967r9

Submission

The approval of both WAPI & 802.11i results in divorce from future IEEE work & ISO/IEC irrelevance in WLANs

Approval of 802.11i & WAPI results in two

independent standards

Both standards will become irrelevant

over time

• If JTC1 approves both 802.11i and WAPI during the fast track then two parallel & independent standards will result

– 8802-11+802.11i

– 8802-11+WAPI

• These standards will need to be maintained & extended in the future

• IEEE will continue developing 802.11 but may not support further development of either version of 8802-11

• 8802-11 will become increasingly irrelevant because there will be no body capable & willing to properly develop it

• In the short term, it will be orphaned from many known future 802.11 amendments

Continued relevance requires that only 802.11i

be approved

• All NB’s have a responsibility to only approve the amendment that provides for the future relevance of ISO/IEC 8802-11 standards

• Only approval of 802.11i meets this test

Parallel problems - Irrelevance

November 2005

IEEE 802.11 WG

Slide 31

doc: IEEE 802.11-05/0967r9

Submission

ISO/IEC 8802-11 may be orphaned from many known future IEEE 802.11 amendments & corrigenda

• If IEEE 802.11 stops supporting ISO/IEC 8802-11 development then ISO/IEC 8802-11 development will be orphaned from:– 802.11k (radio resource measurement)

– 802.11ma (rolling up 802.11e/g/h/i/j on the base/a/b/d and other corrections)

– 802.11n (high rate)

– 802.11p (vehicular)

– 802.11r (fast roaming)

– 802.11s (mesh)

– 802.11u (inter-working with external networks)

– 802.11v (wireless network management)

– 802.11w (management frame protection)

• Note that these amendments represent 1,000’s of man years of effort that JTC1 could not hope to duplicate successfully

Parallel problems – Irrelevance - Amendments

November 2005

IEEE 802.11 WG

Slide 32

doc: IEEE 802.11-05/0967r9

Submission

Any WAPI version of ISO/IEC 8802-11 is subject to severe “IPR uncertainty”

IPR statements have been submitted to IEEE

for 802.11

It is not clear these IPR statements apply to a

WAPI version of 8802-11

• Various organisations assert rights to various elements of 802.11

• Most of these organisations have made RAND IPR statements to IEEE

• These statements only apply to specific the IEEE Standard (see IEEE IPR statement)

• These statements do not apply to an ISO standard that is substantially different from the IEEE standard

– ie the 8802-11 plus WAPI standard as proposed by Chinese NB

The IPR issue needs to be understood and

resolved

• An international standard that cannot be legally implemented is not very useful

• It is important for JTC1 to understand and resolve the IPR issue

Parallel standards – IPR

November 2005

IEEE 802.11 WG

Slide 33

doc: IEEE 802.11-05/0967r9

Submission

802.11i is suitable for fast track approval, satisfying the needs of 100’s millions of existing users

November 2005

IEEE 802.11 WG

Slide 34

doc: IEEE 802.11-05/0967r9

Submission

802.11i is suitable for fast track approval, satisfying the needs of 100’s millions of existing users

802.11i benefits

802.11i is suitable for approval using the fast

track process

• 802.11i is a stable & mature standard based on an open and international development process

802.11i provides verifiable security

based on disclosed algorithms

• All 802.11i algorithms are fully specified & disclosed, enabling global interoperability

• 802.11i provides independently verified security satisfying the needs of an international standard

802.11i supports clearly demonstrated

international market requirements

• 802.11i meets international market authentication requirements by supporting RADIUS authentication

• 802.11i provides a migration path for the 200 million existing 8802-11 compliant WEP-only devices

• 802.11i is being shipped in 250,000 new devices every day

November 2005

IEEE 802.11 WG

Slide 35

doc: IEEE 802.11-05/0967r9

Submission

802.11i is a stable & mature standard based on an open & international development process

Fast track is designedfor mature & stable

“existing standards”

802.11i isstable & mature

• The JTC1 fast track process is designed to enable fast processing of an “existing standard”

• It is implicitly assumed that “existing standards” are stable and mature

• The WTO (G/TBT/9) outlines principles for standards development including transparency, openness & consensus

• 802.11i was developed using an open process compatible with ISO/IEC and WTO principles Review by over 500

international engineers Independent review by

cryptographers Sponsor ballot review

by 100 reviewers Interoperability testing

by vendor community 4 years of open

development

• All NBs have a responsibility to approve only mature documents

802.11i is suitablefor fast track review

802.11i benefits - Stable

November 2005

IEEE 802.11 WG

Slide 36

doc: IEEE 802.11-05/0967r9

Submission

802.11i meets international market authentication requirements by supporting RADIUS authentication

Market refused to deploy WLANs without RADIUS

authentication

802.11i supports RADIUS based authentication

• Sales of 8802-11 systems lagged even before any problems with WEP were identified

• The international market demanded reuse of its established authentication technology base

• Each organisation wants to set its own authentication policy

• 802.11i was designed with the goals of Allowing reuse of

existing RADIUS authentication

Making RADIUS authentication as secure as possible in a WLAN

• The international market has rewarded the design by deploying 70 million devices in the first year

Only 802.11i aligns with market realities

• All NBs have a responsibility to align ISO standards with international market reality

802.11i benefits – Market needs

November 2005

IEEE 802.11 WG

Slide 37

doc: IEEE 802.11-05/0967r9

Submission

802.11i provides a migration path for the 200 million existing 8802-11 compliant WEP-only devices

Amendments must be compatible with existing

compliant devices

802.11i supports an upgrade paththrough TKIP

• Amendments of standards should continue to support deployed compliant devices

• 802.11i (1N7904) defines TKIP as a patch applicable to the 200 million existing WEP-only devices

• 802.11i deprecates WEP but allows its use for cases where upgrade is not economically feasible

• 802.11i defers the decision on WEP’s use to a local policy decision, not imposing policy

802.11i is compatible with ISO legacysupport goals

• All NBs have a responsibility to ensure significant numbers of existing devices remain conformant

• 802.11i achieves this goal

802.11i benefits - Migration

November 2005

IEEE 802.11 WG

Slide 38

doc: IEEE 802.11-05/0967r9

Submission

802.11i represents market reality & is being shipped in 250,000 new devices every day

Standards need to reflect market reality

802.11i represents WLAN market reality

• It is vital that standards reflect market reality

• This means that standards must support products that are successful in the market place

• 250,000 802.11i capable devices are being shipped every day as APs, NICs and embedded devices

• The massive success of 802.11i can be contrasted to a claimed rollout of only 10,000 WAPI APs in western China after 2+ years of rollout (source: Chinese NB at Beijing meeting)

8802-11 must include 802.11i

• The NB’s have a responsibility to ensure 802.11i is incorporated into 8802-11

802.11i benefits - Support

November 2005

IEEE 802.11 WG

Slide 39

doc: IEEE 802.11-05/0967r9

Submission

All 802.11i algorithms are fully specified & disclosed, enabling global interoperability

ISO strive to promote global interoperability

802.11i enables global interoperability

• ISO explicitly states its business goal as promoting interoperability

One standard, one test, and one conformity assessment procedure accepted everywhere

• All of 802.11i is specified in 1N7903 or in other publicly available documents

• All authentication mechanisms used by 802.11i are defined in publicly available documents

• All mandatory-to-implement 802.11i algorithms are in the public domain

• All NBs have a responsibility to only approve amendments that promote global interoperability

Only 802.11i supports global interoperability

802.11i benefits - Disclosed

November 2005

IEEE 802.11 WG

Slide 40

doc: IEEE 802.11-05/0967r9

Submission

802.11i provides independently verified security satisfying the needs of an international standard

Security claims standards should be

independently verifiable

All 802.11i security claims have

independently verified

• Standards should not make unsubstantiated security claims

• All security claims must be independently verified

• Numerous independent cryptographic reviews have verified 802.11i security claims Including by R. Rivest,

D. Wagner, P. Rogaway, J. Jonsson, S. Langford, J. Kelsy, etc.

• No fundamental security flaw has been identified by any independent review

802.11i security is appropriate for an

international standard

• All NBs have a responsibility to promote standards whose security claims are independently verified

802.11i benefits - Verified

November 2005

IEEE 802.11 WG

Slide 41

doc: IEEE 802.11-05/0967r9

Submission

A no-no vote is not defensible on any technical grounds

November 2005

IEEE 802.11 WG

Slide 42

doc: IEEE 802.11-05/0967r9

Submission

A no-no vote is not defensible on any technical grounds

• There is substantial technical justification for a yes vote on 802.11i  (1N7903)

• There is substantial technical justification for a no vote on WAPI (1N7904)

November 2005

IEEE 802.11 WG

Slide 43

doc: IEEE 802.11-05/0967r9

Submission

A harmonised approach is desirableas long as the Chinese NB are willing to participate

November 2005

IEEE 802.11 WG

Slide 44

doc: IEEE 802.11-05/0967r9

Submission

A harmonised approach is desirable as long as the Chinese NB are willing to participate

• Harmonisation advantages outweigh the disadvantages– Addresses the needs of all

– Ensures all useful technology is included

– Ensures an evolving standard that is secure, open & implementable

– Takes time but so do “good” standards

• IEEE 802 is eager to facilitate a “harmonised standard”

• IEEE 802 & ISO leadership have suggested a number of harmonisation mechanisms based on approved ISO/IEC processes for collaboration with IEEE 802– See 8802-1:2001 (Feb 01), 6N11917 (April 01)

• So far none of the harmonisation mechanisms have been accepted by the Chinese NB

• The key to success of the harmonisation approach is Chinese NB willingness to participate

Harmonised

November 2005

IEEE 802.11 WG

Slide 45

doc: IEEE 802.11-05/0967r9

Submission

Harmonisation addresses the needs of all, providing an evolving standard that is secure, open & implementable

• Ensures all market needs (from China and rest of the world) are addressed by enabling global input

• Incorporates the best technology from both WAPI and 802.11i

• Provides a standard that is secure, open, complete and implementable

• Ensures a living standard compatible with existing & future 802.11 amendments

• Provides the best way for the Chinese NB to work constructively in international standards bodies

• Defines the only way to incorporate WAPI technology that is acceptable to the international standards community and the global WLAN market

Harmonised - Positives

November 2005

IEEE 802.11 WG

Slide 46

doc: IEEE 802.11-05/0967r9

Submission

Harmonisation takes time but so do “good” standards

• It will take substantial effort and some time to complete harmonisation– Some elements of WAPI can be harmonised relatively quickly

— for example, SHA-256 can be integrated with 802.11 within six months

– Some elements may take make longer

— for example, WAI needs to be standardised in the appropriate forum

• However, good standards inevitably take time to complete– Time is required for complete and accurate review

– Time is required for consensus building

• We should let the engineers participating in the harmonisation process determine the best scope, solution and timing

Harmonised - Barriers

November 2005

IEEE 802.11 WG

Slide 47

doc: IEEE 802.11-05/0967r9

Submission

IEEE 802 is eager to facilitate a “harmonised standard” to achieve 802.11/WAPI integration

ISO IEEE 802 802.11 SG 802.11 TG

• Agree on “harmonised standard” approach

• Either delay or approve 802.11i

• Approve formation of 802.11 Study Group

• Confirm scope of 802.11 amendment including WAPI technology

• Write 802.11 amendment

…

• Approved in July 2005 to support existing ISO & IEEE collaboration agreement

• SC6 NB participation invitation issued in Saint-Paul de Vence, with full SG voting rights

• SG starts in Nov 05 in Vancouver

• Participating NBs receive Immediate SG voting rights

• SG can conduct interim meetings in more convenient locations,e.g. China

Previous suggestion from IEEErejected by China NB

Harmonised - IEEE

November 2005

IEEE 802.11 WG

Slide 48

doc: IEEE 802.11-05/0967r9

Submission

IEEE have suggested harmonisation mechanisms based on approved ISO/IEC collaboration processes

Harmonised - IEEE

ISO/IEC JTC1/SC6 appoint an Ad hoc Working Group (AHWG) to develop an outline & timetable for integration of elements of the WAPI technology & 802.11i into ISO/IEC 8802-11

The AHWG formally liaise with IEEE 802 to ensure the outline represents a feasible way to integrate WAPI technology & 802.11i into 8802-11 & IEEE Standard 802.11

The work defined by the outline & schedule for integration of WAPI technology & 802.11i into ISO/IEC 8802-11 & IEEE Standard 802.11 be executed in appropriate WGs within ISO/IEC JTC1/SC6 & IEEE 802, as agreed jointly by JTC1/SC6 and IEEE 802

A very close liaison be established to track and review the work as it develops in JTC1/SC 6 and IEEE 802 to ensure compatibility is maintained with existing and developing ISO/IEC 8802-11 and 802.11 amendments.

As long as progress continues, ISO/IEC JTC1 delay resumption of the 802.11i fast track ballot and not consider any other security related amendments to 8802-11

Process proposed by IEEE at Beijing meeting (August 2005)

IEEE

Accept

SAC

Reject

ANSI

Reject

KATS

Abstain

Results

November 2005

IEEE 802.11 WG

Slide 49

doc: IEEE 802.11-05/0967r9

Submission

The key to success of the harmonisation approach is Chinese NB willingness to participate

• Harmonisation of WAPI & 802.11i is a desirable goal

• IEEE 802 even offered to delay 802.11i standardisation to achieve this goal

• However, the Chinese NB has refused all suggestions to achieve harmonisation

• The most desirable approach is a “yes” vote for 802.11i (1N7903) & a “no” vote for WAPI (1N7904)– It enables the future of an international standard reflecting the market reality of a growing

base of 100’s millions of 8802-11 and 802.11i users– It may motivate the Chinese NB to participate in a harmonisation process, including

normal JTC1/IEEE collaboration mechanisms

• A “no” vote for both 802.11i (1N7903) & WAPI (1N7904) is an acceptable but less desirable outcome– It might lead to harmonisation but provides little incentive to do so– It is more likely to lead to delay & uncertainty given the historical unwillingness of the

Chinese NB to discuss harmonisation

• In either of the above cases, IEEE 802 will continue to seek harmonisation of 802.11i & WAPI

Harmonised - Participation