eap Mailing List: Re: Eap keying review: use of MSK/ EMSK for AMSK creation

[Jari Arkko (jari.arkko]

Hi Joe,

> [Joe] This is OK the EAP Authenticator and EAP Server can be viewed as
> part of the same logical entity with repsec to the lower layer.  It
> probably should say that once the key is delivered to the lower layer it
> should be deleted from the EAP Authenticator and EAP server.
>  
Yes. One question that comes up in this context is
how to ensure that the lower layer can't "re-request" the
same AMSK. One answer to this is that the lower layer
must initially make a request of all AMSKs, and the EAP
layer ensures that it does not deliver more than one
key for one (application id, parameters) pair.

--Jari