Subject: [eap] Proposed Resolution to Issue 214: Keying Appendix E vs. EMSK Guidelines

From: Bernard Aboba <[email-masked]>
Date: Wed, 3 Mar 2004 19:58:55 -0800 (PST)

The text of Issue 214 is enclosed below.  The proposed resolution is as
follows:

Change Appendix E to the following:

"Appendix E. AAA-Key Derivation

As discussed in [I-D.irtf-aaaarch-handoff], [IEEE-02-758],
[IEEE-03-084], and [8021XHandoff], keying material may be required
for use in fast handoff between IEEE 802.11 authenticators. Where the
backend authentication server provides keying material to multiple
authenticators in order to fascilitate fast handoff, it is highly
desirable for the keying material used on different authenticators to
be cryptographically separate, so that if one authenticator is
compromised, it does not lead to the compromise of other
authenticators. Where keying material is provided by the backend
authentication server, a key hierarchy derived from the EMSK,
can be used to provide cryptographically separate keying material
for use in fast handoff:

AAA-Key-A = MSK(0,63)

AAA-Key-B = PRF(EMSK(0,63),"EAP AAA-Key derivation for multiple
attachments",
AAA-Key-A,B-Called-Station-Id,Calling-Station-Id)

AAA-Key-E = PRF(EMSK(0,63),"EAP AAA-Key derivation for multiple
attachments",
AAA-Key-A,E-Called-Station-Id,Calling-Station-Id)

Where:

Calling-Station-Id = peer identity
B-Called-Station-Id = second attachment point identity
E-Called-Station-Id = third attachment point identity

Here AAA-Key-A is the AAA-Key derived during the initial EAP
authentication between the peer and authenticator A. Based on this
initial EAP authentication, the EMSK is also derived, which can be
used to derive AAA-Keys for fast authentication between the EAP peer
and authenticators B and E. Since the EMSK is cryptographically
separate from the MSK, each of these AAA-Keys is cryptographically
separate from each other, and are guaranteed to be unique between the
EAP peer (also known as the STA) and the authenticator (also known as
the AP)."

---------------------------------------------------------------------
Issue 214: Keying appendix E vs. EMSK guidelines
Submitter name: Jari Arkko
Submitter email address: [email-masked]
Date first submitted: Jan 21, 2004
Reference:
Document: Keying Framework-01
Comment type: T
Priority: 1
Section: Appendix E
Rationale/Explanation of issue:

Appendix E of keying-01 talks about the derivation of
suitable AAA Keys for handoff situations. It gives the
following formulae:

    AAA-Key-B      = PRF(EMSK(0,63),AAA-Key-A,
                     B-Called-Station-Id,Calling-Station-Id)

    AAA-Key-E      = PRF(EMSK(0,63),AAA-Key-A,
                     E-Called-Station-Id,Calling-Station-Id)

But draft-salowey-eap-keying-02 discusses EMSK usage, and
I think we have agreed at least about this:

      o The application MUST NOT use the EMSK in any other way except to
         derive Application Master Session Keys (AMSK) using the key
         derivation specified in section 3 this document.  They MUST NOT
         use the EMSK directly.

      o Applications MUST define distinct key labels and application
         specific data used in the key derivation described in section 3.

Appendix E appears to break the second requirement. Joe's
draft gives the following construction for AMSKs:

       AMSK = KDF(EMSK, key label, optional application data, length)

Perhaps appendix E could be corrected to be inline with this?
Here's the suggested text change:

    AAA-Key-B      = PRF(EMSK(0,63),"EAP AAA-Key derivation for multiple
attachments",
                     AAA-Key-A,B-Called-Station-Id,Calling-Station-Id)

    AAA-Key-E      = PRF(EMSK(0,63),"EAP AAA-Key derivation for multiple
attachments",
                     AAA-Key-A,E-Called-Station-Id,Calling-Station-Id)

Also, the rules about the calling and called station ids could perhaps
be made less link layer specific:

     Calling-Station-Id  = STA MAC address
     B-Called-Station-Id = AP B MAC address
     E-Called-Station-Id = AP E MAC address

=>

     Calling-Station-Id  = peer identity
     B-Called-Station-Id = second attachment point identity
     E-Called-Station-Id = third attachment point identity

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Joseph Salowey" <[email-masked]>
Date: Wed, 3 Mar 2004 20:44:37 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Bernard Aboba
> Sent: Wednesday, March 03, 2004 7:59 PM
> To: [email-masked]
> Subject: [eap] Proposed Resolution to Issue 214: Keying 
> Appendix E vs. EMSK Guidelines
> 
> 
> [IEEE-03-084], and [8021XHandoff], keying material may be 
> required for use in fast handoff between IEEE 802.11 
> authenticators. Where the backend authentication server 
> provides keying material to multiple authenticators in order 
> to fascilitate fast handoff, it is highly desirable for the 
> keying material used on different authenticators to be 
> cryptographically separate, so that if one authenticator is 
> authenticators. Where keying material is provided by the 
> backend authentication server, a key hierarchy derived from 
> the EMSK, can be used to provide cryptographically separate 
> keying material for use in fast handoff:
> 

[Joe] DO you think that keys will always be distributed from the AAA or
may it be distributed from a separate server?  If it is possible that
you may want to distribute this functionality then you should derive a
separate AMSK from the EMSK so you avoid exporting the EMSK. 

> AAA-Key-A = MSK(0,63)
> 
> AAA-Key-B = PRF(EMSK(0,63),"EAP AAA-Key derivation for 
> multiple attachments",

[Joe] AAA-Key-B = PRF(EMSK(0,63),"EAP AAA-Key derivation for 
multiple attachments",
AAA-Key-A,B-Called-Station-Id,Calling-Station-Id,length)

> 
> AAA-Key-E = PRF(EMSK(0,63),"EAP AAA-Key derivation for 
> multiple attachments",
[Joe] AAA-Key-E = PRF(EMSK(0,63),"EAP AAA-Key derivation for 
multiple attachments",
AAA-Key-A,E-Called-Station-Id,Calling-Station-Id, length)

> E-Called-Station-Id = third attachment point identity

[Joe] length = length of derived key material

> Here AAA-Key-A is the AAA-Key derived during the initial EAP 

[Joe] Here the AAA-Key-A is the MSK derived during the initial EAP

> authentication between the peer and authenticator A. Based on 
> this initial EAP authentication, the EMSK is also derived, 
> which can be used to derive AAA-Keys for fast authentication 
> between the EAP peer and authenticators B and E. Since the 
> EMSK is cryptographically separate from the MSK, each of 
> these AAA-Keys is cryptographically separate from each other, 
> and are guaranteed to be unique between the EAP peer (also 
> known as the STA) and the authenticator (also known as the AP)."
> 
> Also, the rules about the calling and called station ids 
> could perhaps be made less link layer specific:
>