eap Mailing List: Proposed resolution to Issue 210: No name for "root" key

[Bernard Aboba (aboba]

The text of Issue 210 is available for inspection at:
http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20210

The proposed resolution is as follows:

Add the following definition to Section 2.1:

Long Term Credential
     EAP methods frequently make use of long term secrets in order to
     enable authentication between the peer and server.  In the case of
     a method based on pre-shared key authentication, the long term
     credential is the pre-shared key.  In the case of a public-key
     based method, the long term credential is the corresponding private
     key.

Change Figure 3 to the following:

  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+         ---+
  |                                                         |            ^
  |                EAP Method                               |            |
  |                                                         |            |
  | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   +-+-+-+-+-+-+-+   |            |
  | |                                 |   |             |   |            |
  | |       EAP Method Key            |<->| Long-Term   |   |            |
  | |         Derivation              |   | Credential  |   |            |
  | |                                 |   |             |   |            |
  | |                                 |   +-+-+-+-+-+-+-+   |  Local to  |
  | |                                 |                     |       EAP  |
  | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                     |     Method |
  |   |             |               |                       |            |
  |   |             |               |                       |            |
  |   |             |               |                       |            |
  |   |             |               |                       |            |
  |   V             |               |                       |            |
  | +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ |            |
  | |  TEK      | | MSK       | |EMSK       | |IV         | |            |
  | |Derivation | |Derivation | |Derivation | |Derivation | |            |
  | +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ |            |
  |                 |               |                 |     |            |
  |                 |               |                 |     |            V
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+         ---+
                    |               |                 |                  ^
                    |               |                 |                  |
                    | MSK (64B)     | EMSK (64B)      | IV (64B)         |
                    |               |                 |          Exported|
                    |               |                 |              by  |
                    V               V                 V              EAP |
            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+  Method|
            |          AAA  Key Derivation,     | | Known       |        |
            |          Naming & Binding         | |(Not Secret) |        |
            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+        V
                    |                                                 ---+
                    |                                        Transported |
                    | AAA-Key                                     by AAA |
                    |                                           Protocol |
                    V                                                    V
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+                                    ---+
     |                           |                                       ^
     |            TSK            |                           Ciphersuite |
     |        Derivation         |                              Specific |
     |                           |                                       V
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+                                    ---+

                            Figure 3: EAP Key Hierarchy