eap Mailing List: Re: Relationship between AAA-Key and MSK/EMSK

[Jari Arkko (jari.arkko]

Nick Petroni wrote:
> On the topic of the distinction between AAA and MSK keys, it seems Figure
> 4 in the keying document adds to the confusion (at least for me). The
> figure shows the peer, authenticator, and backend all having access to the
> MSK. As previously noted in this thread, sometimes AAA == MSK, but
> potentially not. If I understand this correctly, I would say the middle
> box, which depicts the authenticator, should have "AAA" instead of "MSK".
> Perhaps AAA should also be indicated on the peer and backend, probably in
> addition to MSK and EMSK.  

I think that's right. Some of this was already noted in
issue #216. But we should also show AAA-Key in the peer and the
backend.

--Jari