Subject: [eap] Proposed Resolution to Issue 265

From: Bernard Aboba <[email-masked]>
Date: Tue, 19 Oct 2004 19:16:59 -0700 (PDT)

The text of Issue 265 is enclosed below.  The proposed
resolution is as follows:

In Section 6.1, change:

" The EMSK MUST remain on the EAP peer and EAP server where it is
derived; it MUST NOT be transported to, or shared with, additional
parties, or used to derive any other keys."

To:

" The EMSK MUST remain on the EAP peer and EAP server where it is
derived; it MUST NOT be transported to, or shared with, additional
parties, or used for purposes other than AMSK derivation (see
Appendix F)."

----------------------------------------------------------------
Issue 265: EMSK Transport
Submitter name: Florent Bersani
Submitter email address: [email-masked]
Date first submitted: 7/30/2004
Reference: http://mail.frascone.com/pipermail/eap/2004-July/002697.html
Document: Keying-03
Comment type: T
Priority: S
Section: 6.1
Rationale/Explanation of issue

*"The EMSK MUST remain on the EAP peer and EAP server where it is
derived; it MUST NOT be transported to, or shared with, additional
parties, or used to derive any other keys."*

First I am not sure of this requirement and second, I guess we should
have a clear definition of what another party is (e.g., we can have
clusters of AAA for safe failover or we can have a wireless switch
acting as a standalone authenticator that has multiple wireless
termination points...)

[BA] The "used to derive any other keys" part seems obsolete given the
AMSK discussion.

"Another party" refers to an entity other than the EAP peer and EAP
server. The definitions of those entities are included in RFC 3748 so they can't
be changed. The definitions of peer, authentication and server in RFC 3748
don't say anything about a single port/entity, so it seems to me that
implementation architectures such as clustering or WLAN switches are
already allowed.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap