eap Mailing List: RE: About use of EMSK

[Nakhjiri Madjid-MNAKHJI1 (Madjid.Nakhjiri]

>From previous discussion, I personally made the conclusion that the EAP
server/ AAA server/ backend server are collocated. And as a consumer of
EAP keying, I came to think that AAA layer at the backend is implemented
by AAA servers, while EAP method/EAP auth layers are implemented by EAP
server. I don't really have a reason to worry about what AAA layer is,
except trying to understand EAP keying documentations and figure out
where I get my keys (AMSK at this point) from and so far I have not
understood it. So if we say EMSK-AMSK generation at AAA layer would
require changes to AAA servers, I can accept that, but 

Are we now saying that AAA layer does not correspond to functionality at
AAA servers and AAA clients??? I am lost! Who implements AAA layer?

Madjid 

> >
> Clarified this point. In your answer you specify "only" lower layer. 
> Did you forget to include AAA layer ? Or do you think AAA layer might 
> receive EMSK?.
> 

[Joe] this would depend on where you draw your AAA and EAP server
boundaries.  They are two separate entities and do not even need to be
collocated, but it is fairly common for the EAP server and AAA server to
be collocated or for the EAP server to be part of the AAA server.  How
the EAP server and AAA server divide up their responsibilities depends
upon local implementation so I would say that the AAA server may know
the EMSK as far as it may contain the EAP server. Now I am not sure what
the AAA layer is, but it may not be the same as a AAA server so I can't
really answer your question.  It would seem that the AAA layer would
include the AAA client and AAA server communication.  The EMSK does not
pass through this communication so under this definition it would not go
to the AAA layer.  

> "what layer (EAP method layer, EAP peer/authenticator layer, EAP 
> layer, lower layer/AAA layer) is intended to get EMSK to create new 
> possible keys (AMSK)?"
> 
> (From your previous answer, it is clear we can discard lower layer as 
> a possible answer)
> 
[Joe] I'm not convinced that I understand the layers or that the layer
model is the right thing to apply here,  but given the choices my answer
is the EAP method layer.