Subject: [eap] Review: draft-puthenkulam-eap-binding-01.txt

From: [email-masked] (Puthenkulam, Jose P)
Date: Mon, 3 Mar 2003 14:53:37 -0800

Hi Jukka,

Some comments below

>Why we wouldn't solve the case in the following way:
>
>(1) The outer protocol should be used only for server authentication
>    and to offer privacy for the client during authentication. The keying
>    material produced by the outer protocol would not be used anymore for
>    session protection.
>(2) The session keys would be derived on the basis of the inner protocol.
>
This is a possible solution, but then cryptographic binding can provide
stronger keys than session keys generated by some inner methods like EAP-SIM
or EAP-MSCHAPv2. Also tunnel keys afford the only protection for non-key
deriving methods. So don't see why tunnel keys that are typically
strong need to be avoided. 

best regards,
jose
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: [email-masked] (Jari Arkko)
Date: Tue, 04 Mar 2003 09:57:51 +0200

> strong need to be avoided. 

This is an interesting discussion! I'd like to understand more about
exactly when Jukka's solution (inner keys), Jose's solution (compound keys),
and the current tunneling solution (outer keys) can and should be used. There's
a number of relevant cases:

* Non-key deriving methods: here we have a choice of no keys at all,
   or the keys from the outer method. What are the tradeoffs? Or
   perhaps there are only positive effects from the use of the keys?

* Strong, modern methods that generate good keys: should we only
   rely on the inner keys here, or consider only the use of the tunnel
   keys or compound keys? Again, what are the tradeoffs? There seems
   to be at least some issues in exporting e.g. TLS keys from the
   tunnel and use them elsewhere. What are the advantages of the
   compound keys in this scenario?

* Methods that generate bad keys ;-)

Jari