eap Mailing List: Re: FW: [eap] Re: EAP key binding discussion

[Bernard Aboba (aboba]

> Sorry for the late response to this. I have written something up. It is
> more a problem statement than a solution proposal. Basically because I
> was not sure whether sending the AAA key to some place other than an
> authenticator is against EAP key management principals.

The Housley Criteria are described in RFC 4017 as well as the EAP Key
Management framework.

In particular, I would pay attention to the "Confidentiality" condition
(which prohibits disclosure of keys to parties outside the peer, server
and authenticator), the "mutual authentication" condition which requires
mutual authentication between all parties, and the "domino effect"
condition which prevents compromise of one party from affecting other
parties.