eap Mailing List: Re: Key derivation and the principle of equivalence

[Bernard Aboba (aboba]

> If I understand your comment correctly, even if the key Management
> framework document defines EAP session-ID (or some other attribute
> that servers as key versioning), if Diameter EAP needs to carry that
> attribute, I think the attribute needs to be added in Diameter EAP
> document and recycling would be needed anyways.

Yes, I think that's true.

> Yes.  One means for that is to define a different type of
> AVP/attribute for a AAA protocol to differenciate AMSK from MSK.

I think this would require defining of a grouped AVP, since if there are
multiple keys to be sent it would be necessary to tie together the key,
session-ID and key-type AVPs.  It also might make sense to define AVPs for
the Peer-ID, Server-ID and Key-Lifetime within the same grouped AVP.