Subject: RE: [eap] Relationship between AAA-Key and MSK/EMSK

From: Nick Petroni <[email-masked]>
Date: Wed, 17 Mar 2004 01:33:36 -0500 (EST)

On the topic of the distinction between AAA and MSK keys, it seems Figure
4 in the keying document adds to the confusion (at least for me). The
figure shows the peer, authenticator, and backend all having access to the
MSK. As previously noted in this thread, sometimes AAA == MSK, but
potentially not. If I understand this correctly, I would say the middle
box, which depicts the authenticator, should have "AAA" instead of "MSK".
Perhaps AAA should also be indicated on the peer and backend, probably in
addition to MSK and EMSK.  Any other thoughts on this?

thanks,
nick

On Fri, 6 Feb 2004, Joseph Salowey wrote:

> Hi Hannes,
>
> I agree the definition of the AAA-key seems incomplete, I think the
> definition is any key that is used by the authenticator and supplicant
> to derive keys for data traffic protection (I don't think AAA-key is the
> best name since it doesn't have to involve a AAA in the basic case).
> In the case of standard 802.11 this AAA-Key the same as the MSK.  In the
> fast handoff example I believe additional AAA-keys are pushed to
> neighboring access points.  In order to provide computational
> independence from the MSK they should be derived from the EMSK.
>
> I have submitted an issue in email
> http://mail.frascone.com/pipermail/eap/2004-January/002143.html (which
> has not yet been assigned a number) which describes how to derive keys
> from the EMSK for specific purposes.   I think appendix e needs to be
> updated as discussed in Issue 214
> http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20214.  I haven't
> had time to take a detailed look at Jari's proposal.  I'm not sure why
> the A-AAA-Key is needed in this derivation but it is equivalent to the
> MSK.
>
> Could you provide some more context from your discussion?  What exactly
> are you deriving keys to do? In my opinion it is best to use the MSK as
> in the case of 802.11 (single authenticator to supplicant).  If keys are
> going to be used for other purposes, between other parties or in other
> ways they should be derived from the EMSK.
>
> Thanks,
>
> Joe
>
>
> [email-masked] wrote:
> > hi all,
> >
> > this issue come up when we discussed (Yoshi, Alper, Jari) the
> > relationship between the AAA-key and the MSK/EMSK in PANA .
> >
> > it is said that the AAA-Key is derived from the MSK and EMSK.
> >
> > the eap-keying document does not specify how this key
> > derivation is achieved.
> > worse, in Section 4.2.1 the text says:
> >
> > "  The AAA-Key is derived from the keying material exported by the EAP
> >    method (MSK and EMSK).  This derivation occurs on the AAA
> > server.  In
> >    many existing protocols that use EAP, the AAA-Key and MSK are
> >    equivalent, but more complicated mechanisms are possible (see
> > Appendix E for details). "
> >
> > appendix e, however, does not help since it talks only about
> > a very special case, namely fast handoff.
> >
> > we dicussed this issue in one of the eap keying design team
> > phone conferences but it got lost somehow.
> >
> > it would be more helpful to provide a proposal for AAA-Key to
> > MSK/EMSK key derivation.
> >
> > ciao
> > hannes
> > _______________________________________________
> > eap mailing list
> > [email-masked]
> > http://mail.frascone.com/mailman/listinfo/eap
>
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Wed, 17 Mar 2004 21:38:59 +0200

Nick Petroni wrote:
> addition to MSK and EMSK.  

I think that's right. Some of this was already noted in
issue #216. But we should also show AAA-Key in the peer and the
backend.

--Jari

---

From: "Joseph Salowey" <[email-masked]>
Date: Wed, 17 Mar 2004 12:25:33 -0800

[email-masked] wrote:
> Nick Petroni wrote:
>> On the topic of the distinction between AAA and MSK keys, it seems
>> Figure 4 in the keying document adds to the confusion (at least for
>> me). The figure shows the peer, authenticator, and backend all having
>> access to the MSK. As previously noted in this thread, sometimes AAA
>> == MSK, but potentially not. If I understand this correctly, I would
>> say the middle box, which depicts the authenticator, should have
>> "AAA" instead of "MSK". Perhaps AAA should also be indicated on the
>> peer and backend, probably in addition to MSK and EMSK.
> 
[Joe] I still think the quantity AAA-Key is not well defined.  I'm not
quite sure what AAA-key is supposed to represent. What is it used for?
Today it is used for link-layer-encryption and it is the MSK.  Using
this key for other purposes may lead to loss of computational
independence and result in problems.   The use of the work AAA-key is
misleading in the context it is currently being used. I think it would
be better to discuss things in terms of applications specific keys, with
one of the applications being link layer encryption.  I'll create an
issue with some proposed text for discussion.

---

From: Nick Petroni <[email-masked]>
Date: Wed, 17 Mar 2004 15:41:05 -0500 (EST)

> [Joe] I still think the quantity AAA-Key is not well defined.  I'm not
[np] Joe, I couldn't agree more. I welcome some discussion on the topic.

> quite sure what AAA-key is supposed to represent. What is it used for?
[np] I think it represents the trust relationship between the AP and the
AAA...*something* has to be transferred so that the AP is in the loop.
Where this comes from and how it is used should, indeed, be clearly
defined.

> this key for other purposes may lead to loss of computational
[np] Yes, this is for certain. Is it possible to make the MSK/AAA only for
link-layer-encryption and use the EMSK for all other things? I think you
suggested something similar to this before, but I'm not sure I understood
completely.

> misleading in the context it is currently being used. I think it would
[np] yeah, I think AAA key is the wrong term as well.

Regards,
nick