Subject: [eap] Issue: AAA-Key should be derived from AMSK

From: "Joseph Salowey" <[email-masked]>
Date: Mon, 4 Oct 2004 21:32:53 -0700

Description of issue
Submitter name: Joe Salowey
Submitter email address: [email-masked]
Date first submitted: 10/4/2004
Reference: 
Document: Keying Framework
Comment type: 'T'echnical
Priority: 'S' Must fix
Section: 2.2, Appendix C, Appendix E
Rationale/Explanation of issue:

The AAA-Key should be derived from the EMSK directly, it should either be
derived from the MSK alone or form an AMSK (which is derived from the EMSK).
This is to limit the exposure of the EMSK outside of the EAP framework and
to ensure that the EMSK derivation maitnains computational separation of
keys.  

Requested change:

Section 2.2:

Change 
"On both the peer and EAP server, the exported MSK and EMSK are
   utilized in order to calculate the AAA-Key, as described in Appendix
   E."
To

"On both the peer and EAP server, the exported MSK and keys derived from the
EMSK (AMSK) are
   utilized in order to calculate the AAA-Key, as described in Appendix
   E."

Figure 3 should be changed to show that the AAA-Key is derived from an AMSK

Appendix C:

Figure C1 should show the AMSK going to the backend server instead of the
EMSK

Appendix E:

The EMSK should not be used directly in AAA-Key derivation. Text follows:

 "Where keying material is provided by the backend
   authentication server, a key hierarchy derived from the EMSK, can be
   used to provide cryptographically separate keying material for use in
   fast handoff.  Instead of using the EMSK directly a application specific
   key is derived, the AMSK, as described in seciton F:

   AAA-Key-A = MSK(0,63)
   AAA-Key-B = PRF(AMSK(0,63),"EAP AAA-Key derivation for
               multiple attachments", AAA-Key-A,B-Called-Station-Id,
               Calling-Station-Id,length)

   AAA-Key-E = PRF(AMSK(0,63),"EAP AAA-Key derivation for
               multiple attachments",AAA-Key-A,E-Called-Station-Id,
               Calling-Station-Id, length)"

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Florent Bersani <[email-masked]>
Date: Tue, 05 Oct 2004 08:54:43 +0200

Joe,

I believe this is tracked as Issue 266 
(http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20266) isn't it?

Thanks for proposing text :-)) I concur.

Florent

Joseph Salowey wrote:

>The AAA-Key should be derived from the EMSK directly,
>
I assume that you meant *should not*

> it should either be

---

From: Jari Arkko <[email-masked]>
Date: Tue, 05 Oct 2004 13:51:10 +0300

I agree with you and Florent that this is a problem.

>    utilized in order to calculate the AAA-Key, as described in Appendix

Maybe s/EMSK (AMSK)/AMSK/ -- the AMSK is already introduced earlier
as is the fact that AMSK is derived from the exported quantities.

> Figure 3 should be changed to show that the AAA-Key is derived from an AMSK

Yes.

> Figure C1 should show the AMSK going to the backend server instead of the

Yes.

>    key is derived, the AMSK, as described in seciton F:

Maybe: "Where keying material is provided by the backend authentication
server, a key hierarchy derived from the MSK and the AMSK can be
used to ..."

>                Calling-Station-Id, length)"

Ok.

--Jari

---

From: Florent Bersani <[email-masked]>
Date: Tue, 05 Oct 2004 16:36:02 +0200

A quick comment in-line

Joseph Salowey wrote:

>...
>   fast handoff.
I do not think that fast handoff is the only application that may 
benefit from such a scheme... although it is clearly a natural one!
So i'd suggest being less specific and saying sth like:

"Where keying material is provided by the backend
   authentication server, a key hierarchy derived from the EMSK
*and the MSK as Jari noted*
, can be
   used to provide cryptographically separate keying material
*for different applications. Fast handoffs are an example application that may benefit from this keying material"

>  Instead of using the EMSK directly a application specific

---

From: "Joseph Salowey" <[email-masked]>
Date: Tue, 5 Oct 2004 09:24:29 -0700

> (http://www.drizzle.com/~aboba/EAP/eapissues.html#Issue%20266)  isn't

[Joe] Yes it is, we can merge them.  I think there still is the whole issue
whole issue of the AAA-Key usage in fast handoff which is currently under
discussion.

>> derived from the MSK alone or form an AMSK (which is derived from the
>> EMSK). This is to limit the exposure of the EMSK outside of the EAP
>> framework and to ensure that the EMSK derivation maitnains
>> computational separation of keys.
>> 
>> Requested change:
>> 
>> Section 2.2:
>> 
>> Change
>>   utilized in order to calculate the AAA-Key, as described in
>> Appendix   E." To
>> 
>> "On both the peer and EAP server, the exported MSK and keys derived
>>   from the EMSK (AMSK) are utilized in order to calculate the
>> AAA-Key, as described in Appendix   E." 
>> 
>> Figure C1 should show the AMSK going to the backend server instead
>> of the EMSK 
>> 
>> 
>> Appendix E:
>> 
>>   authentication server, a key hierarchy derived from the EMSK, can
>>   be used to provide cryptographically separate keying material for
>>   use in fast handoff.  Instead of using the EMSK directly a
>>   application specific key is derived, the AMSK, as described in
>> seciton F: 
>> 
>>   AAA-Key-A = MSK(0,63)

---

From: "Joseph Salowey" <[email-masked]>
Date: Tue, 5 Oct 2004 09:27:26 -0700

Jari Arkko wrote:
> Maybe s/EMSK (AMSK)/AMSK/ -- the AMSK is already introduced
> earlier as is the fact that AMSK is derived from the exported
> quantities. 
> 

[Joe] Yes, thanks. 

> Maybe: "Where keying material is provided by the backend
> authentication server, a key hierarchy derived from the MSK
> and the AMSK can be used to ..."
> 

[Joe] perhaps "an AMSK" instead of "the AMSK".  There can be more than one
AMSK for different purposes.

---

From: "Joseph Salowey" <[email-masked]>
Date: Tue, 5 Oct 2004 09:28:55 -0700

Florent Bersani wrote:
>> use in   fast handoff. 
> benefit from such a scheme... although it is clearly a
> natural one! So i'd suggest being less specific and saying sth like:
> 
>    authentication server, a key hierarchy derived from the
> EMSK *and the MSK as Jari noted* , can be
> *for different applications. Fast handoffs are an example
> application that may benefit from this keying material"
> 

[Joe] perhaps it should be "the EMSK and/or the MSK"

---

From: Florent Bersani <[email-masked]>
Date: Wed, 06 Oct 2004 08:37:21 +0200

>[Joe] perhaps it should be "the EMSK and/or the MSK" 
that's right

---

From: Florent Bersani <[email-masked]>
Date: Wed, 06 Oct 2004 10:59:55 +0200

A humorous note on this one: I like the way Bernard tracked it

Issue 266 status is now rejected as a duplicate of... issue 275

In my narrow-minded western vision of the flowing of time, I'd have put 
that the other way round.... ;-)

Florent