Subject: [eap] Issue 254: Key Lifetime Issues

From: Bernard Aboba <[email-masked]>
Date: Sat, 21 Aug 2004 13:56:40 -0700 (PDT)

Issue 254: Key Lifetime Issues
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: 8/8/2004
Reference:
Document: Keying-03
Comment type: T
Priority: S
Section: 2.3
Rationale/Explanation of issue

The Key Lifetime section does not address several issues:

* Re-key. Section 2.3 should discuss the distinction between
re-key and re-authentication. EAP does not support rekey
without re-authentication for the exported keys:
MSK, EMSK, IV. However, the Secure Association Protocol
may support rekey of the TSKs without re-authentication.

* Caching. Section 2.3 should discuss the potential implications of
key caching, for each type of key. Caching of exported keys varies
between lower layers, and as a result, EAP or EAP methods do not
negotiate the lifetime of exported keys. However, even lower
layers that support caching do not negotiate the exported key
lifetime between the peer and authenticator. Section 2.3
should lay out the potential options for cache
synchronization and analyze the pros and cons.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Sun, 22 Aug 2004 09:29:16 +0300

I agree that we need to discuss the re-key and caching
issues on a per-key basis.

--Jari