Subject: [AAA-WG]: Issue 195: Clarifications on key generation

From: Pat Calhoun <[email-masked]>
Date: Sun, 7 Oct 2001 08:30:47 -0700

All,

This issue contains three requests:

1. change registration key -> session key for consistency

	ok

2. add text on key derivation in section 5.3

	This key is not derived. The actual session key is added to
	to the message, as are all other keys destined for the
	Diameter nodes. So this request is denied

3. change in aaa-key-08

	I will send a note to Charlie, who currently owns the source
	to consider this change.

If folks agree with 1&2, I can close this issue.

PatC

---

From: "Mark Jones" <[email-masked]>
Date: Tue, 9 Oct 2001 09:54:15 -0400

Pat,

> 	Diameter nodes. So this request is denied

My original question was how this actual session key was generated. If the
Foreign-Home session key generation is considered outside the scope of the
draft, it would be helpful if this was explicitly stated in the draft.

The generation of the Mobile-Home and Mobile-Foreign session keys is
described (via a reference to the MIPv4 AAA keys draft) so one would expect
the Foreign-Home session key generation to be described too.

Regards,
       Mark

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 10 Oct 2001 07:23:34 -0700

> the Foreign-Home session key generation to be described too.

section 5.3 states:

"If the home agent is in the home realm, then AAAH has to generate the
Foreign-Home session key. Otherwise, it is generated by AAAF.

In either case, the AAA server encodes the session key into a
MIP-HA-to-FA-Key AVP and includes that AVP as part of the HAR message
sent to the home agent, and waits for the HAA message to be returned.

Upon receipt of the HAR, the home agent recovers the Foreign-Home
session key, allocates an SPI to be used with the key. The 
allocated SPI is included in the HAA's MIP-FA-to-HA SPI AVP.

..."

So the question is how the key is created, right? This, btw, is no different
than the Mobile-Foreign and Mobile-Home key that is sent to the FA and HA,
respectively. So, perhaps some additional text on key creation, and the fact that
it is a random value of at least 128 bits. 

Would this be sufficient? Could this be added to section 6.8, with the necessary
references in 5.x?

PatC

---

From: "Mark Jones" <[email-masked]>
Date: Wed, 10 Oct 2001 11:39:00 -0400

Pat,

> it is a random value of at least 128 bits.

This is the second time you've stated that the Foreign-Home key creation is
no different than the Mobile-Foreign and Mobile-Home key creation and I
still fail to see the commonality. Please could you review my assumptions on
Mobile-Foreign and Mobile-Home key generation (from aaa-key-09) so I can see
where I'm mistaken.

+ The Mobile-Foreign and Mobile-Home Key Material is a random value of at
least 64 bits.

+ The Mobile-Foreign and Mobile-Home Session Key is the result of a
cryptographic algorithm (default: HMAC_MD5) applied over some combination of
node address, AAA-key and the key material.

So when you say "it is a random value of at least 128 bits", are you
referring to the Foreign-Home Key Material or the Foreign-Home Session Key
itself?

This is the first time I've seen mention of a random value of 128 bits used
in key creation. Did you mean 64 bits?

> Would this be sufficient? Could this be added to section 6.8,

If all session keys are created in the same way then I'd add the description
(or reference) to section 6.8 (MIP-Session-Key AVP). If they are not, I'd
describe their creation in the appropriate 5.x section.

Regards,
       Mark

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 10 Oct 2001 09:34:32 -0700

the draft that refer to below (aaa-keys) describes how the keys are sent to the mobile
node, not to the FA or HA.

So, let's look at an example:

1. aaah creates key material
2. session key is created from key material by aaah, and sent to HA and FA via 
   Diameter
3. key material is sent from aaah to ha
3. key material is sent to mobile node in reg reply
4. session key is created from key material by mobile node

So, keys destined for the FA and the HA are session keys, not the key material.

and yes, I meant 64 bits, not 128 (sorry)

PatC

---

From: Michael Chen <[email-masked]>
Date: Wed, 10 Oct 2001 10:07:54 -0700

Is aaa-key-09 available? Or it's just a typo by Mark?

Mark Jones wrote:

> ......
> ------

---

From: "Mark Jones" <[email-masked]>
Date: Wed, 10 Oct 2001 13:30:57 -0400

Michael,

See the post by Charles Perkins on the mobile ip mailing list dated October
8th.

	http://people.nokia.net/charliep/txt/mobilekey/mip-key.txt

Regards,
       Mark

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Michael Chen
> Sent: October 10, 2001 1:08 PM
> To: Mark Jones
> Cc: Pat Calhoun; [email-masked]
> Subject: Re: [AAA-WG]: Issue 195: Clarifications on key generation
>
>

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 14 Oct 2001 07:43:01 -0700

All,

After having read the draft some more, I do agree with some of Mark's
comments, in that it isn't entirely clear in the draft how some keys are
sent to some entities. So I have reworked section 5.0 into two sections,
and would solicit comments.

Text below.

Thanks,

PatC
----

5.0  Key Distribution Center

   The mobile node and mobility agents use session keys to compute
   authentication extensions applied to registration messages, as
   defined in [4]: Mobile-Foreign, Foreign-Home and Mobile-Home.  If
   session keys are requested the AAA server(s) MUST return the key
   material after the Mobile Node is successfully authenticated and
   authorized.

   If the AAAH does not communicate directly with the foreign agent, and
   it does not wish for intermediate proxies to have access to the
   session keys, they SHOULD be protected using the CMS security
   application [9].

   The MIP-Key-Lifetime AVP contains the number of seconds before
   session keys destined for the Home Agent and/or Foreign Agent expire.
   A value of zero indicates infinity (no timeout).

   The SPI values are used as key identifiers, meaning that each session
   key has its own SPI value; nodes that share a key also share an SPI.
   The Mobile Node proposes SPIs for use in computing the Mobile-Foreign
   and Mobile-Home authentication extensions, via the Mobile IP AAA Key
   Request extensions [15], while the Home Agent allocates the Mobile-
   Foreign, Mobile-Home and Foreign-Home SPIs.

   Once the session keys have been distributed, subsequent Mobile IP
   registrations need not invoke the AAA infrastructure until the keys
   expire.  These registrations MUST include the Mobile-Home
   authentication extension.  In addition, subsequent registrations MUST
   also include Mobile-Foreign authentication extension if the Mobile-
   Foreign key was generated and distributed by AAA; similarly for
   subsequent use of the Foreign-Home authentication extensions.

5.1  Key Material vs. Session Key

   Each session key that is generated by the AAAH will generally be
   distributed to two parties; for instance, a Mobile-Foreign is sent to
   both the mobile node and the foreign agent.

   The key sent to the mobile node is always in the form of key
   material, which the AAAH does by generating a random [18] value of at
   least 64 bits. The random value is used by the mobile node to create
   the actual session key. The following is an example of a session
   creation procedure, using MD5 as the hashing algorithm. Additional
   algorithms are supported, and listed in [15].

      MD5(AAA-Key | key material | node-address | AAA-Key)

      Where:

         - AAA-Key is the long term secret shared between the mobile
           node and the AAAH.
         - Key material is a random [18] value of at least 64 bits.
         - node-address is the mobile node's identity. This is the
           contents of the MIP-Mobile-Node-Address AVP, unless the value
           of the AVP is all zero or ones, in which case of value of the
           User-Name AVP is used instead.

   The AAAH then generates the session key which is destined for the
   mobility agent, in this case the foreign agent, by following the
   above procedures.  It is important that the hashing algorithm used by
   the mobile node is the same as the one used by the AAAH in the
   session key generation procedure.  Therefore, the AAAH MUST know a
   priori the transform used, which is typically contained in the mobile
   node's configuration profile. The session keys destined for mobility
   agents are encoded using the security association available between
   the AAA server and the agents (e.g. IPSec, TLS, CMS).

   See sections 6.0 for details about the format of the AVPs used to
   transport the session keys.

---

From: Mark Eklund <[email-masked]>
Date: Mon, 15 Oct 2001 11:00:50 -0400

Pat,
This clears up a lot for me, but I have a question.

 >    and Mobile-Home authentication extensions, via the Mobile IP AAA Key

Does this mean that the AAAH needs to speak mobile ip to extract this
SPI or will there be a new AVPs sent in the AMR for that?  Note that
you need to have two different AVPs since the Generalized MN-FA Key
Request Extension and the Generalized MN-HA Key Request Extension
could contain two different SPIs.

-mark

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 15 Oct 2001 07:47:39 -0700

> This clears up a lot for me, but I have a question.

good... progress.

> could contain two different SPIs.

no, the AAAH MUST NOT need to know how to parse Mobile IP registration messages.

PatC