Subject: [eap] Relationship between AAA-Key and MSK/EMSK

From: Tschofenig Hannes <[email-masked]>
Date: Fri, 6 Feb 2004 16:38:30 +0100

hi all, 

this issue come up when we discussed (Yoshi, Alper, Jari) the relationship
between the AAA-key and the MSK/EMSK in PANA . 

it is said that the AAA-Key is derived from the MSK and EMSK. 

the eap-keying document does not specify how this key derivation is
achieved. 
worse, in Section 4.2.1 the text says: 

"  The AAA-Key is derived from the keying material exported by the EAP
   method (MSK and EMSK).  This derivation occurs on the AAA server.  In
   many existing protocols that use EAP, the AAA-Key and MSK are
   equivalent, but more complicated mechanisms are possible (see
   Appendix E for details).
"

appendix e, however, does not help since it talks only about a very special
case, namely fast handoff. 

we dicussed this issue in one of the eap keying design team phone
conferences but it got lost somehow. 

it would be more helpful to provide a proposal for AAA-Key to MSK/EMSK key
derivation. 

ciao
hannes
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Joseph Salowey" <[email-masked]>
Date: Fri, 6 Feb 2004 09:18:18 -0800

Hi Hannes,

I agree the definition of the AAA-key seems incomplete, I think the
definition is any key that is used by the authenticator and supplicant
to derive keys for data traffic protection (I don't think AAA-key is the
best name since it doesn't have to involve a AAA in the basic case).
In the case of standard 802.11 this AAA-Key the same as the MSK.  In the
fast handoff example I believe additional AAA-keys are pushed to
neighboring access points.  In order to provide computational
independence from the MSK they should be derived from the EMSK.  

I have submitted an issue in email
http://mail.frascone.com/pipermail/eap/2004-January/002143.html (which
has not yet been assigned a number) which describes how to derive keys
from the EMSK for specific purposes.   I think appendix e needs to be
updated as discussed in Issue 214
http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20214.  I haven't
had time to take a detailed look at Jari's proposal.  I'm not sure why
the A-AAA-Key is needed in this derivation but it is equivalent to the
MSK.  

Could you provide some more context from your discussion?  What exactly
are you deriving keys to do? In my opinion it is best to use the MSK as
in the case of 802.11 (single authenticator to supplicant).  If keys are
going to be used for other purposes, between other parties or in other
ways they should be derived from the EMSK.  

Thanks,

Joe

[email-masked] wrote:
> hi all,
> 
> this issue come up when we discussed (Yoshi, Alper, Jari) the
> relationship between the AAA-key and the MSK/EMSK in PANA .
> 
> the eap-keying document does not specify how this key
> derivation is achieved.
> Appendix E for details). "
> 
> appendix e, however, does not help since it talks only about
> a very special case, namely fast handoff.
> 
> we dicussed this issue in one of the eap keying design team
> phone conferences but it got lost somehow.
> 
> it would be more helpful to provide a proposal for AAA-Key to
> MSK/EMSK key derivation. 
> 
> ciao
> hannes

---

From: John Vollbrecht <[email-masked]>
Date: Fri, 06 Feb 2004 12:49:06 -0500

This brings up a point that I haven't been able to understand - see below
--On Friday, February 6, 2004 9:18 AM -0800 Joseph Salowey 

> independence from the MSK they should be derived from the EMSK.
I don't understand why we would derive a MSK and EMSK that are at the same 
level, then use the MSK for the current AP but derive new keys from the 
EMSK for other APs.

It seems to me that it would be more consistent to derive all keys the same 
way, perhaps from the MSK.   But then I don't understand the value of the 
EMSK, since everything can be derived from the MSK.

I had thought that the MSK was meant to allow backward compatibility with 
existing Key mechanisms, and the EMSK would do future things.  Perhaps this 
is the case, but it seems to me that deriving everything the same way would 
be more consistent and easier to understand.

Is the MSK mean to be equivalent to the EMSK except that the MSK is only 
used for existing implementations, or am I misunderstanding something?

---

From: "Joseph Salowey" <[email-masked]>
Date: Fri, 6 Feb 2004 10:11:54 -0800

[email-masked] wrote:
> This brings up a point that I haven't been able to understand
> - see below --On Friday, February 6, 2004 9:18 AM -0800
> Joseph Salowey
>> definition is any key that is used by the authenticator and
>> supplicant to derive keys for data traffic protection (I don't think
>> AAA-key is the best name since it doesn't have to involve a AAA in
>> the basic case). In the case of standard 802.11 this AAA-Key the
>> same as the MSK.  In the fast handoff example I believe additional
>> AAA-keys are pushed to neighboring access points.  In order to
>> provide computational independence from the MSK they should be
>> derived from the EMSK. 
>> 
> existing Key mechanisms, and the EMSK would do future things. 
> Perhaps this is the case, but it seems to me that deriving everything
> the 
> same way would

[Joe] Basically you are correct.  The reason for the EMSK is because
existing schemes already use the MSK directly in specific ways (dynamic
WEP for example).  If we could start over we could just have one key and
derive everything from that.  We could decide to deprecate the MSK and
derive everything from the EMSK. 

>> has not yet been assigned a number) which describes how to derive
>> keys from the EMSK for specific purposes.   I think appendix e needs
>> to be updated as discussed in Issue 214
>> http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20214.  I
>> haven't had time to take a detailed look at Jari's proposal.  I'm not
>> sure why the A-AAA-Key is needed in this derivation but it is
>> equivalent to the MSK. 
>> 
>> Could you provide some more context from your discussion?  What
>> exactly are you deriving keys to do? In my opinion it is best to use
>> the MSK as in the case of 802.11 (single authenticator to
>> supplicant). If keys are going to be used for other purposes,
>> between other parties or in other ways they should be derived from
>> the EMSK. 
>> 
>> Thanks,
>> 
>> Joe
>> 
>> 
>>> achieved. worse, in Section 4.2.1 the text says:
>>> 
>>> "  The AAA-Key is derived from the keying material exported by the
>>>    EAP method (MSK and EMSK).  This derivation occurs on the AAA
>>>    server. In many existing protocols that use EAP, the AAA-Key and
>>>    MSK are equivalent, but more complicated mechanisms are possible
>>> (see Appendix E for details). " 
>>> 
>>> appendix e, however, does not help since it talks only about a very
>>> special case, namely fast handoff.
>>> 
>>> [email-masked] http://mail.frascone.com/mailman/listinfo/eap
>> 
>> [email-masked] http://mail.frascone.com/mailman/listinfo/eap

---

From: John Vollbrecht <[email-masked]>
Date: Fri, 06 Feb 2004 13:37:10 -0500

Thanks for the reply-

> derive everything from the EMSK.

Why don't we just derive everything from the EMSK.  We could derive the MSK 
from the EMSK and then MSK' from the EMSK for a second AP, and then MSK'' 
for the third AP, and then MSK'' for some other application.  It seems to 
make things conceptually simpler and easier to understand if it is done 
this way. Am I missing something?
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Joseph Salowey" <[email-masked]>
Date: Mon, 9 Feb 2004 16:39:05 -0800

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of John Vollbrecht
> Sent: Friday, February 06, 2004 10:37 AM
> To: Joseph Salowey; 'Tschofenig Hannes'; [email-masked]
> Subject: RE: [eap] Relationship between AAA-Key and MSK/EMSK
> 
> 
> Thanks for the reply-
> 
> > > - see below --On Friday, February 6, 2004 9:18 AM -0800 Joseph 
> > > Salowey <[email-masked]> wrote:
> > >
> > >> Hi Hannes,
> > >>
> > >> supplicant to derive keys for data traffic protection (I don't 
> > >> think AAA-key is the best name since it doesn't have to 
> involve a 
> > >> AAA in the basic case). In the case of standard 802.11 
> this AAA-Key 
> > >> the same as the MSK.  In the fast handoff example I believe 
> > >> additional AAA-keys are pushed to neighboring access points.  In 
> > >> order to provide computational independence from the MSK they 
> > >> should be derived from the EMSK.
> > >>
> > > I don't understand why we would derive a MSK and EMSK that are at 
> > > the same level, then use the MSK for the current AP but derive new
> > > keys from the
> > > EMSK for other APs.
> > >
> > > It seems to me that it would be more consistent to derive 
> all keys 
> > > the same
> > > I had thought that the MSK was meant to allow backward 
> compatibility 
> > > with existing Key mechanisms, and the EMSK would do future things.
> > > Is the MSK mean to be equivalent to the EMSK except that 
> the MSK is 
> > > only used for existing implementations, or am I misunderstanding 
> > > something?
> > >
> >
> > existing schemes already use the MSK directly in specific ways 
> > (dynamic WEP for example).  If we could start over we could 
> just have 
> > one key and derive everything from that.  We could decide 
> to deprecate 
> > the MSK and derive everything from the EMSK.
> >
> 

[Joe] This would be simpler, but it would break the way existing methods
derive keys. What I would like to see is we only use the MSK for its
current (legacy) usage.  For everything else we derive from the EMSK.  I
think this is feasible if the current consumers of EAP use it in this
way.  This is currently difficult since the EAP 2284bis does not define
how to use the EMSK.  There is also the problem of delivering the key
material to the NAS. RADIUS does not deifne a very flexible way to do
this and it doesn't appear that Diameter does either.