Subject: [eap] Proposed resolution to Issue 220: Relationship between AAA-Key and MSK/EMSK

From: Bernard Aboba <[email-masked]>
Date: Wed, 3 Mar 2004 20:22:56 -0800 (PST)

The text of Issue 220 is enclosed below.  The proposed resolution is as
follows:

Add the following paragraph to the beginning of Appendix E:

Where a AAA-Key is generated as the result of a successful EAP
authentication, the AAA-Key is set to MSK(0,63).

--------------------------------------------------------
Issue 220: Relationship between AAA-Key and MSK/EMSK
Submitter name: Hannes Tschofenig
Submitter email address: [email-masked]
Date first submitted: 2/6/2004
Reference:
http://mail.frascone.com/pipermail/public/eap/2004-February/002231.html
Document: Key Framework
Comment type: T
Priority: S
Section: Various
Rationale/Explanation of issue:

it is said that the AAA-Key is derived from the MSK and EMSK.

the eap-keying document does not specify how this key derivation is
achieved. Worse, in Section 4.2.1 the text says:

"  The AAA-Key is derived from the keying material exported by the EAP
   method (MSK and EMSK).  This derivation occurs on the AAA server.  In
   many existing protocols that use EAP, the AAA-Key and MSK are
   equivalent, but more complicated mechanisms are possible (see
   Appendix E for details).
"

Appendix e, however, does not help since it talks only about a very
special case, namely fast handoff.

We discussed this issue in one of the eap keying design team phone
conferences but it got lost somehow.

It would be more helpful to provide a proposal for AAA-Key to MSK/EMSK key
derivation.

[Joe Salowey]

I agree the definition of the AAA-key seems incomplete, I think the
definition is any key that is used by the authenticator and supplicant
to derive keys for data traffic protection (I don't think AAA-key is the
best name since it doesn't have to involve a AAA in the basic case).
In the case of standard 802.11 this AAA-Key the same as the MSK.  In the
fast handoff example I believe additional AAA-keys are pushed to
neighboring access points.  In order to provide computational
independence from the MSK they should be derived from the EMSK.

I have submitted an issue in email
http://mail.frascone.com/pipermail/eap/2004-January/002143.html (which
has not yet been assigned a number) which describes how to derive keys
from the EMSK for specific purposes.   I think appendix e needs to be
updated as discussed in Issue 214
http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20214.  I haven't
had time to take a detailed look at Jari's proposal.  I'm not sure why
the A-AAA-Key is needed in this derivation but it is equivalent to the
MSK.

Could you provide some more context from your discussion?  What exactly
are you deriving keys to do? In my opinion it is best to use the MSK as
in the case of 802.11 (single authenticator to supplicant).  If keys are
going to be used for other purposes, between other parties or in other
ways they should be derived from the EMSK.

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Joseph Salowey" <[email-masked]>
Date: Wed, 3 Mar 2004 20:24:44 -0800

Why isn't the AAA-Key equivalent to the MSK?  Exposing the notion of a
AAA-Key is not so good since it suggests things would work differently
with a AAA server and without.  I don't think we want this.  We should
not define a AAA-Key that is different than the MSK.  

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Bernard Aboba
> Sent: Wednesday, March 03, 2004 8:23 PM
> To: [email-masked]
> Subject: [eap] Proposed resolution to Issue 220: Relationship 
> between AAA-Key and MSK/EMSK
> 
> 
> Where a AAA-Key is generated as the result of a successful 
> EAP authentication, the AAA-Key is set to MSK(0,63).
> 
> the eap-keying document does not specify how this key 
> derivation is achieved. Worse, in Section 4.2.1 the text says:
> 
> Appendix e, however, does not help since it talks only about 
> a very special case, namely fast handoff.
> 
> We discussed this issue in one of the eap keying design team 
> phone conferences but it got lost somehow.
> 
> It would be more helpful to provide a proposal for AAA-Key to 
> MSK/EMSK key derivation.
> 
> [Joe Salowey]
> 
> I agree the definition of the AAA-key seems incomplete, I 
> think the definition is any key that is used by the 
> authenticator and supplicant to derive keys for data traffic 
> protection (I don't think AAA-key is the best name since it 
> doesn't have to involve a AAA in the basic case). In the case 
> of standard 802.11 this AAA-Key the same as the MSK.  In the 
> fast handoff example I believe additional AAA-keys are pushed 
> to neighboring access points.  In order to provide 
> computational independence from the MSK they should be 
> derived from the EMSK.
> 
> http://mail.frascone.com/pipermail/eap/2004-January/002143.htm
l (which has not yet been assigned a number) which describes how to
derive keys

---

From: Jari Arkko <[email-masked]>
Date: Thu, 04 Mar 2004 09:05:03 +0200

>>EAP authentication, the AAA-Key is set to MSK(0,63).

Or is your issue Joe that the length difference causes
something? Or that the pure existence of a value called
the AAA key is harmful, because that implies the existence
of AAA, which might not always be present?

I think we need a quantity for this purpose. I'm even fine
with the value being called "MSK" if the length and other
considerations allow it. Or we could call it the FOO-Key,
always present in an authenticator, be it a AAA-based or
a standalone...

--Jari

---

From: "Joseph Salowey" <[email-masked]>
Date: Thu, 4 Mar 2004 09:43:00 -0800

Hi Jari,

I think this is mostly a naming issue.  AAA-Key indicates something
specific to AAA, which I don't think is appropriate.  Instead of AAA-Key
perhaps we should use something like Application Master Session Key
(AMSK).  Here is some text along what I am thinking.  It needs some
work, but here is the general idea:

EAP may provide keying material to multiple applications.  Each
application should have its own computationally independent AMSK.
Traditionally the application used with EAP is link layer ciphering.  In
this case the AMSK is derived from the MSK[0..64].  Since some link
layer ciphering applications use this key directly (dynamic-wep) it is
NOT RECOMMENDED that the MSK be used to derive keys for other purposes.
For other applications the AMSK SHOULD be derived from the EMSK using
the guidelines outlined in the document.  In some cases the AMSK must be
transferred from an EAP Server to a NAS or other device. In this case an
AMSK is transmitted in a AAA-Token (perhaps key-token is better?)
containing the AMSK and the AMSK name.  Applications must define what
parameters are used in deriving the AMSK and how the keys are used.  In
some cases they will have to define how the AAA-token/key-token is
transferred from the EAP server to where it is used.  

Do you agree with this direction?

Joe
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Wednesday, March 03, 2004 11:05 PM
> To: Joseph Salowey
> Cc: 'Bernard Aboba'; [email-masked]
> Subject: Re: [eap] Proposed resolution to Issue 220: 
> Relationship between AAA-Key and MSK/EMSK
> 
> 
> 
> Joseph Salowey wrote:
> something? Or that the pure existence of a value called the 
> AAA key is harmful, because that implies the existence of 
> AAA, which might not always be present?
> 
> always present in an authenticator, be it a AAA-based or a 
> standalone...
> 
> --Jari
> 
> Submitter name: 
> >>Hannes Tschofenig Submitter email address: 
> >>[email-masked] Date first submitted: 2/6/2004
> >>Reference: 
> > http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20214.  I 
> > haven't had time to take a detailed look at Jari's 
> proposal.  I'm not 
> > sure why the A-AAA-Key is needed in this derivation but it is 
> > equivalent to the MSK.
> > 
> > Could you provide some more context from your discussion?  What 
> > exactly are you deriving keys to do? In my opinion it is 
> best to use 
> > the MSK as in the case of 802.11 (single authenticator to 
> supplicant).  
> > If keys are going to be used for other purposes, between 
> other parties 
> > or in other ways they should be derived from the EMSK.
> > 
> > [email-masked] http://mail.frascone.com/mailman/listinfo/eap
> > 
> > [email-masked] http://mail.frascone.com/mailman/listinfo/eap
> > 
> > 
> 
>