eap Mailing List: Re: EAP Key Management Framework doubt

[Jari Arkko (jari.arkko]

Rafa Marín Lopez wrote:

> > Figure 4 shows that MSK is placed on Authenticator but only AAA-key is 
> > transported from AAA server... ? ... furthermore the text tells MSK 
> > is transported to Authenticator... in another places AAA-key is 
> > carried ... I think it would be better to say : AAA - key is carried 
> > to authenticator and it could be the MSK (as appendix E tells)... what 
> > do you think?

I'm not sure I can find the place that you find confusing. Can you
point us to the location in the text where it says that the MSK is
transported to the authenticator?

Or perhaps its this text:

   The MSK and EMSK are used to derive the AAA-Key and key name which
   are enclosed within the AAA-Token, transported to the  NAS by the AAA
   server, and used within the secure association protocol for
   derivation of Transient Session Keys (TSKs) required for the
   negotiated ciphersuite.

This may be confusing, as the subject of transportation is not perhaps
clear. How about this instead:

   The MSK and EMSK are used to derive the AAA-Key and key name. AAA-Key
   and key name are enclosed within the AAA-Token, which is transported to the
   NAS by the AAA server, and used within the secure association protocol for
   derivation of Transient Session Keys (TSKs) required for the
   negotiated ciphersuite.

--Jari