eap Mailing List: Re: Issue 236: (Key Framework) Rewrite of Section 2

[Florent Bersani (florent.bersani]

Hi Bernard,

Some (minor) comments in-line.

Florent

Bernard Aboba wrote:

> Issue 236: Rewrite of Section 2
> Submitter name: Bernard Aboba
> Submitter email address: aboba [at] internaut.com
> Date first submitted: 4/3/2004
> Reference:
> Document: Keying-01
> Comment type: T/E
> Priority: S
> Section: 2
> Rationale/Explanation of issue:
>
>
>
> ...
> 2.2.  Key Hierarchy
>
>   The EAP Key Hierarchy, illustrated in Figure 3 below, includes three
>   types of keys:
>  
Well, I see four types of keys

>    [1] Keys calculated locally by the EAP method but not exported,
>        such as the TEKs.
>    [2] Keys exported by the EAP method: MSK, EMSK, IV 

> and
>        keys calculated from exported quantities: AAA-Key.
>  
Shouldn't this be a (logically) separated type?

>    [3] Keys calculated by the Secure Association Protocol: TSKs.
>
>   In order to protect some or all of the EAP conversation, EAP methods
>   supporting key derivation typically negotiate a ciphersuite and
>   derive Transient EAP Keys (TEKs) to provide keys for that
>   ciphersuite.  However, the TEKs are stored locally within the EAP
>   method and are not exported.
>  
Does this preclude TEK caching? My answer is no. Is clarification 
required to specify what does "be exported" and "not be exported" mean?