eap Mailing List: Re: WGLC for eap-keying: EAP server-AAA server

[Jari Arkko (jari.arkko]

The conclusion of this appears to be -

o Terms AAA server, backend authentication server,
EAP server: EAP server is a different entity.
But it would be useful to use a single term for the
"backend authentication server"/AAA server. THe
document already states that the terms are
used interchangeably. For backwards compatibility
reasons (e.g. RFC 3748) we should not delete the
terms, but use just one through the eap-keying
document.

o Definition of "export". Not sure if we need to add
anything here.

o AAA-Key. There has indeed been confusion. But
It seems that Bernard's new definition works:

AAA-Key

The term "AAA-Key" is synonymous with MSK.

o Use of MSK as a basis for AMSKs. This appears to
not possible due to the use MSK for another purpose
already.

o Definition of PMK. We may need to say less here.
Suggested text:

Pairwise Master Key (PMK)
Lower layers use MSK in lower-layer dependent manner.
For instance, in [IEEE-802.11i] Octets 0-31 of the MSK
are known as the Pairwise Master Key (PMK). In
[IEEE-802.11i] the TKIP and AES CCMP ciphersuites derive
their Transient Session Keys (TSKs) solely from the PMK, whereas
the WEP ciphersuite as noted in [RFC3580], derives its TSKs from
both halves of the MSK. In [802.16e], the MSK is truncated to
40 octets for PMK and 20 octets for PMK2.

and delete PMK usage from Appendix A.

o Definition of AMSKs here vs. in the extensions.
We have discussed this in other threads already.
I think we were leaning on defining them here,
but we can discuss this issue in the meeting today.

--Jari