Subject: [eap] Review: draft-puthenkulam-eap-binding-01.txt

From: [email-masked] (Puthenkulam, Jose P)
Date: Wed, 5 Mar 2003 10:04:56 -0800

This discussion need some more contextual information to be considered for
getting sense of what keys to use where. Today, one key issue in WLANs is a
consistent level of security. 802.11i prescribes 256 bits of keying material
that is needed. Now several methods may be capable of generating the
required keying material but with varying strengths. So assuming that each
WLAN hotspot could support multiple credentials, the security of the air
link is going to be different for each method. So tunnel methods will help
provide a consistent strength for the keying material irrespective of the
specific method used. Now specific method keys if they are strong could also
be used, but for some methods like EAP-SIM the strength can vary based on
the specific SIM algorithm in use.

So what is the best solution? Is it good to rely on method specific keys and
then have the air link security only as good as your weakest link. Or
provide method independent keys like tunnel methods do and provide a
consistent level of security.

Just some thoughts to consider in this discussion,

best regards,
jose

-----Original Message-----
From: Jari Arkko [mailto:[email-masked]] 
Sent: Monday, March 03, 2003 11:58 PM
To: Puthenkulam, Jose P
Cc: [email-masked]'; [email-masked]
Subject: Re: [eap] Review: draft-puthenkulam-eap-binding-01.txt

Puthenkulam, Jose P wrote:

>>Why we wouldn't solve the case in the following way:
>>
>>(1) The outer protocol should be used only for server authentication
>>   and to offer privacy for the client during authentication. The keying
>>   material produced by the outer protocol would not be used anymore for
>>   session protection.
>>(2) The session keys would be derived on the basis of the inner protocol.
>>
> 
> This is a possible solution, but then cryptographic binding can provide
> stronger keys than session keys generated by some inner methods like
EAP-SIM
> or EAP-MSCHAPv2. Also tunnel keys afford the only protection for non-key
> deriving methods. So don't see why tunnel keys that are typically
> strong need to be avoided. 

This is an interesting discussion! I'd like to understand more about
exactly when Jukka's solution (inner keys), Jose's solution (compound keys),
and the current tunneling solution (outer keys) can and should be used.
There's
a number of relevant cases:

* Non-key deriving methods: here we have a choice of no keys at all,
   or the keys from the outer method. What are the tradeoffs? Or
   perhaps there are only positive effects from the use of the keys?

* Strong, modern methods that generate good keys: should we only
   rely on the inner keys here, or consider only the use of the tunnel
   keys or compound keys? Again, what are the tradeoffs? There seems
   to be at least some issues in exporting e.g. TLS keys from the
   tunnel and use them elsewhere. What are the advantages of the
   compound keys in this scenario?

* Methods that generate bad keys ;-)

Jari

---

From: [email-masked] (Joseph Salowey)
Date: Wed, 5 Mar 2003 10:24:26 -0800

> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Puthenkulam, Jose P
> Sent: Wednesday, March 05, 2003 10:05 AM
> To: [email-masked]'; Puthenkulam, Jose P
> Subject: RE: [eap] Review: draft-puthenkulam-eap-binding-01.txt
> 
> 
> This discussion need some more contextual information to be 
> considered for getting sense of what keys to use where. 
> Today, one key issue in WLANs is a consistent level of 
> security. 802.11i prescribes 256 bits of keying material that 
> is needed. Now several methods may be capable of generating 
> the required keying material but with varying strengths. So 
> assuming that each WLAN hotspot could support multiple 
> credentials, the security of the air link is going to be 
> different for each method. So tunnel methods will help 
> provide a consistent strength for the keying material 
> irrespective of the specific method used. Now specific method 
> keys if they are strong could also be used, but for some 
> methods like EAP-SIM the strength can vary based on the 
> specific SIM algorithm in use.
> 
[Joe] All the EAP methods I can think of have variable security
properties including PEAP and EAP-TLS.  The security will vary based on
the ciphersuites used and the parameters of the ciphersuites (key length
etc.), some of which is not typically specified.  The security of
EAP-SIM is more associated with the strength of Ki ranther than the SIM
algorithm (unless you are using the same Ki outside of EAP-SIM). 

> So what is the best solution? Is it good to rely on method 
> specific keys and then have the air link security only as 
> good as your weakest link. Or provide method independent keys 
> like tunnel methods do and provide a consistent level of security.
> 

[Joe] Currently I am of the opinion that combined keys provides the best
solution.  Combined keys should provide the potential to be stronger
than either individual key.  I need to think more about Jukka's
proposal.  

> > This is a possible solution, but then cryptographic binding can 
> > provide stronger keys than session keys generated by some inner 
> > methods like
> EAP-SIM
> > or EAP-MSCHAPv2. Also tunnel keys afford the only protection for 
> > non-key deriving methods. So don't see why tunnel keys that are 
> > typically strong need to be avoided.
> 
> This is an interesting discussion! I'd like to understand 
> more about exactly when Jukka's solution (inner keys), Jose's 
> solution (compound keys), and the current tunneling solution 
> (outer keys) can and should be used. There's a number of 
> relevant cases:
> 
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>