eap Mailing List: Re: methods and expert reviews

[Thomas Otto (t.otto]

Hi Jesse, 

regarding Section 2 of your review of EAP-PSK: 

> 2. TEK, MSK, and EMSK issues
>
> The derivation of the TEK, MSK, and EMSK depend on only RAND_S and KDK.
> This means the peer assumes (i.e., "trusts") that the server generates a
> statistically unique RAND_S for each session. If the server fails to
> generate a statistically unique RAND_S, then the TEK, MSK, and EMSK are
> compromised on each repeated session.

The derivation of TEK, MSK and EMSK depend on RB and KDK, where RB is 
the 16byte random data of the *client*, that is RAND_P (cf. 2.2.1, p.14 ff. in  
draft-bersani-eap-psk-07.txt).

I'm not sure how this circumstance affects your argumentation in Section 2. 

Regards,
Thomas