eap Mailing List: Proposed Resolution to Issue 323: AAA Key Cache

[Bernard Aboba (bernard_aboba]

The text of Issue 323 is available here:
http://www.drizzle.com/~aboba/EAP/eapissues3.html#Issue%20323

The proposed resolution is as follows:

Change the text in Section 2.3 to the following:

"AAA

Existing AAA client, proxy and server implementations supporting RADIUS/EAP 
[RFC3579] or Diameter
EAP [RFC4072] do not support caching of EAP keying material or
parameters.  In existing AAA client, proxy and server implementations, 
exported EAP
keying material (MSK, EMSK and IV) as well as parameters and
derived keys are not cached and MUST be presumed lost after the AAA
exchange completes.

In order to avoid key reuse, the AAA layer MUST delete transported
keys once they are sent.  The AAA layer MUST NOT retain keys that
it has previously sent.  For example, a AAA
layer that has transported the MSK MUST delete it, and keys MUST
NOT be derived from the MSK from that point forward."