eap Mailing List: Re: About use of EMSK

[Rafa Marin Lopez (rafa]

Hi Joe...

I would like to do some comments to your e-mail. Please see inline...

> [Joe] this would depend on where you draw your AAA and EAP server
> boundaries.  They are two separate entities and do not even need to be
> collocated, but it is fairly common for the EAP server and AAA server to
> be collocated or for the EAP server to be part of the AAA server.  How
> the EAP server and AAA server divide up their responsibilities depends
> upon local implementation so I would say that the AAA server may know
> the EMSK as far as it may contain the EAP server. Now I am not sure what
> the AAA layer is, but it may not be the same as a AAA server so I can't
> really answer your question.  It would seem that the AAA layer would
> include the AAA client and AAA server communication.
My understanding is that figure 3 is referring to AAA server. 

But in any case, i re-formulate the question: if EAP server and AAA 
server are co-located ... could EMSK be exported to AAA server? (From your
answer

"the AAA server may know
the EMSK as far as it may contain the EAP server"

I would say yes .

<snip>

> [Joe] I'm not convinced that I understand the layers or that the layer
> model is the right thing to apply here,  
Ok, I see.   In EAP key mng fwk is described this layering .  
Additionally , let me give some notes about EAP state machine (though it 
is informational).

For example (RFC 4137):

6.1.2.  Variables (Backend Authenticator to AAA Interface)

.....

aaaEapKeyData (EAP key)

     Set in authenticator state machine when keying material becomes
     available.  Set during the METHOD_RESPONSE state.  Note that this
     document does not define the structure of the type "EAP key".  We
     expect that it will be defined in [Keying].

If we check the EAP state machine that method (aaaEapKeyData (EAP key) ) is provided by 
EAP backend authenticator state machine (Figure 5 in rfc 4137). That state machine 
recovers the "EAP key"
from the EAP method through m.getKey()

m.getKey()

     Method procedure to obtain key material for use by EAP or lower
     layers.  Returns an EAP key.

Thus, the layer model remains....


Having said this, and after your comment

My question is : is it expected another interface (different than "aaaEapKeyData 
(EAP key)") to provide keys to AAA server? or could AAA server use for example 
something like m.getKey()
to obtain a particular key from EAP method?.

> but given the choices my answer
> is the EAP method layer. 
>  
In that case, why would EAP method need to export EMSK?.

Thanks.

--
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: rafa [at] dif.um.es
------------------------------------------------------