Subject: [AAA-WG]: Proposed addition to Diameter NASREQ draft

From: [email-masked]
Date: Tue, 15 May 2001 16:45:37 +0300

Hi all,

Please find below a drafty description of key distribution AVP's
which I'd like to propose to be included in the Diameter NASREQ draft. 
These AVP's would be useful for example with IEEE 802.1X.
and PPP encryption (and perhaps with BURP too?).

Any comments most welcome!

Regards,
Henry

-----------

NAS-Session-Key AVP

NAS session keys are the keys created by a Diameter server, which it 
distributes to the NAS, acting as a Diameter client. The keys can
be used for integrity and confidentiality protection between the NAS and
the user. The keys can be distributed to the user for example
as part of the EAP authentication procedure.

If strong authentication and confidentiality of the session keys
is required, it is recommended that the end-to-end security 
extension [TBD] be used with the NAS-Session-Key AVP.

Zero or more instances of the NAS-Session-Key AVP may be present
in the following Diameter messages:

   AA-Answer (AAA) Command   
   Diameter-EAP-Answer (DEA) Command

If more than one instance of the NAS-Session-Key AVP is present,
then for a certain purpose, only one of the distributed session 
keys must be applicable. In other words, one of the following 
conditions must be true for all combinations of two 
NAS-Session-Key AVP's:

   1. Their Key-Usage AVP's are different, or
   2. Their Key-Direction AVP's contain the values "downlink" and
      "uplink".

The lifetime of the generated keys MUST be the same as the 
value of the Authorization-Lifetime AVP. The NAS-Session-Key AVP,
described below, is of type Grouped, and therefore its value has 
the following ABNF format:

   NAS-Session-Key AVP   = Peer-SPI Key-Direction Key-Usage Session-Key
      Peer-SPI        = ; NAS-Peer-SPI, see below
      Key-Direction   = ; NAS-Key-Direction, see below
      Key-Usage       = ; NAS-Key-Usage, see below
      Session-Key     = ; NAS-Key-Data, see below

      +---------------------------------------------------------------+
      |                AVP Header (AVP Code = TBD)                    |
      +---------------------------------------------------------------+
      |                      NAS-Peer-SPI AVP                         |
      +---------------------------------------------------------------+
      |                    NAS-Key-Direction AVP                      |
      +---------------------------------------------------------------+
      |                      NAS-Key-Usage AVP                        |
      +---------------------------------------------------------------+
      |                       NAS-Key Data AVP                        |
      +---------------------------------------------------------------+

NAS-Peer-SPI

The NAS-Peer-SPI AVP (AVP Code TBD) is of type Unsigned32, and it 
contains the Security Parameter Index, selected by the Diameter 
server, which may be used as a key identifier. The SPI is probably 
not useful in PPP.

NAS-Key-Direction

The NAS-Key-Direction AVP (AVP Code TBD) is of type Unsigned32.
It indicates if the key can be used to protect uplink traffic, 
downlink traffic or both uplink and downlink traffic between 
the user and the NAS. The following values are supported:

   0     Bidirectional
   1     Uplink (user to NAS traffic)
   2     Downlink (NAS to user traffic)

NAS-Key-Usage

The NAS-Key-Usage AVP (AVP Code TBD) is of type Unsigned32.
It indicates if the key is intended to be used as an
integrity key or cipher key. The following values are supported:

   0     Cipher key
   1     Integrity key

NAS-Key-Data

The NAS-Key-Data AVP (AVP Code TBD) is of type OctetString and
contains the session key to be used between the user and the NAS.

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 15 May 2001 06:47:22 -0700

> Any comments most welcome!

How are the keys distributed to the user?

PatC