eap Mailing List: RE: Issue: AAA-Key should be derived from AMSK

[Joseph Salowey (jsalowey]

Florent Bersani wrote:
> Joe,
> 
> I believe this is tracked as Issue 266
> (http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20266)  isn't
> it? 
> 

[Joe] Yes it is, we can merge them.  I think there still is the whole issue
whole issue of the AAA-Key usage in fast handoff which is currently under
discussion.

> Thanks for proposing text :-)) I concur.
> 
> Florent
> 
> Joseph Salowey wrote:
> 
>> Description of issue
>> Submitter name: Joe Salowey
>> Submitter email address: jsalowey [at] cisco.com
>> Date first submitted: 10/4/2004
>> Reference:
>> Document: Keying Framework
>> Comment type: 'T'echnical
>> Priority: 'S' Must fix
>> Section: 2.2, Appendix C, Appendix E
>> Rationale/Explanation of issue:
>> 
>> The AAA-Key should be derived from the EMSK directly,
>> 
> I assume that you meant *should not*
> 
>> it should either be
>> derived from the MSK alone or form an AMSK (which is derived from the
>> EMSK). This is to limit the exposure of the EMSK outside of the EAP
>> framework and to ensure that the EMSK derivation maitnains
>> computational separation of keys.
>> 
>> Requested change:
>> 
>> Section 2.2:
>> 
>> Change
>> "On both the peer and EAP server, the exported MSK and EMSK are
>>   utilized in order to calculate the AAA-Key, as described in
>> Appendix   E." To
>> 
>> "On both the peer and EAP server, the exported MSK and keys derived
>>   from the EMSK (AMSK) are utilized in order to calculate the
>> AAA-Key, as described in Appendix   E." 
>> 
>> Figure 3 should be changed to show that the AAA-Key is derived from
>> an AMSK 
>> 
>> Appendix C:
>> 
>> Figure C1 should show the AMSK going to the backend server instead
>> of the EMSK 
>> 
>> 
>> Appendix E:
>> 
>> The EMSK should not be used directly in AAA-Key derivation. Text
>> follows: 
>> 
>> "Where keying material is provided by the backend
>>   authentication server, a key hierarchy derived from the EMSK, can
>>   be used to provide cryptographically separate keying material for
>>   use in fast handoff.  Instead of using the EMSK directly a
>>   application specific key is derived, the AMSK, as described in
>> seciton F: 
>> 
>>   AAA-Key-A = MSK(0,63)
>>   AAA-Key-B = PRF(AMSK(0,63),"EAP AAA-Key derivation for
>>               multiple attachments", AAA-Key-A,B-Called-Station-Id,
>>               Calling-Station-Id,length)
>> 
>>   AAA-Key-E = PRF(AMSK(0,63),"EAP AAA-Key derivation for
>>               multiple attachments",AAA-Key-A,E-Called-Station-Id,
>>               Calling-Station-Id, length)"
>> 
>> 
>> 
>> _______________________________________________
>> eap mailing list
>> eap [at] frascone.com
>> http://mail.frascone.com/mailman/listinfo/eap