Subject: [eap] EAP-SIM fast re-auth identity

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Tue, 5 Apr 2005 10:05:05 -0500

Hi, 

I have a question regarding the EAP-SIM method for fast re-authentication and would appreciate it if the authors and other people respond. Why is a specific identity used for fast re-authentication? What is the problem with using the identities that were used during the full authentication? The initial identity that is sent in EAP-Response/ Identity should not have a problem, right?

Thanks in advance,

Madjid Nakhjiri

---

From: Thomas Wieland <[email-masked]>
Date: Wed, 06 Apr 2005 00:41:14 -0700

Hi Madjid,

I'm not an author but "other people", but maybe I can
shed

some light on this.  Henry can always correct and expand.

There is nothing "wrong" with the identities used during
full

authentication (i.e. either permanent identity, e.g. 1IMSI @realm,

or pseudonym identity).  The "problem", if you will, is
that by

definition of a full authentication, these identities require the

use of 2 or 3 GSM triplets to authenticate.

For one, this implies at least one round trip to a remote server,

i.e. the HLR/AuC where the triplets are generated.  This is

usually much slower than going through the calculations

necessary to iterate the keying material locally at the AAA

server.  It also means additional load on the HLR/AuC.

The second "bad" aspect is that each full EAP-SIM
authentication uses

up 2 or 3 triplets.  The number of triplets that can be generated by
each

SIM is usually limited (e.g. to 50,000) due to security concerns.
This

doesn't matter too much in a GSM mobile network as authentications

only use only one triplet and occur relatively infrequently compared
to,

for example, public WLAN.  For EAP-SIM used in a PWLAN
scenario,

not only do you use up 2 or 3 triplets per authentication, the
authentications

also happen much more frequently.  For example every time every time

a PC gets turned on (or woken up), when a user roams between access

points etc.  You can see how you could be chewing through the
available

triplets pretty fast and once you've reached the limit hard-wired into
the

SIM, your SIM is dead and needs to be replaced.

By using the fast re-auth mechanism, not only do you speed up

EAP-SIM authentications (hence "fast" :-), you also reduce
the

load on the back-end server (AuC) and extend the life of your SIM.

In other words, "it's a good thing".

Regards,

Thomas

At 10:05 05-04-05 -0500, Nakhjiri Madjid-MNAKHJI1 wrote:

Hi,

I have a question regarding the EAP-SIM method
for fast re-authentication and would appreciate it if the authors and
other people respond. Why is a specific identity used for fast
re-authentication? What is the problem with using the identities that
were used during the full authentication? The initial identity that is
sent in EAP-Response/ Identity should not have a problem, right?

Thanks in advance,

Madjid Nakhjiri

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: <[email-masked]>
Date: Wed, 6 Apr 2005 11:34:26 +0300

Hi Madjid, Thomas,
 
Thomas already justified very well why there is a separate fast re-authentication procedure.
 
The use of separate identities on fast re-authentication is just one way to design the re-authentication
procedure. Alternatively, we could have used the same pseudonyms during fast re-authentication.
There are some benefits in using separate identities.
 
Thanks to the separate identities, fast re-authentication and full authentication can be implemented 
separately, more modularly, at the server. When the server runs fast re-authentication, it does not have 
to update the information about the full authentication pseudonym. Fast re-authentication 
could even be distributed to a separate entity, a separate subsystem of the EAP server that
does not need to have any access to the triplets or to other "long-term" state of the subscriber. 
 
A separate fast-reauthentication identity also indicates to the server that the client wants to use
fast re-authentication. Hence it is possible to "overload" the identity with this indication and
save a roundtrip in some cases.
 
When there are several AAA servers, pseudonyms should be decodable by all the servers
at the home network. They should also be decodable a long time after they were delivered.
Hence, the storing mechanism for pseudonyms is likely to be "expensive". Fast re-authentication
identities can be locally administered by a single server, and it does not matter if they are
not stored so "reliably". For example, some EAP-SIM server implementations use cryptographically generated
pseudonyms that contain the IMSI, but use short number IDs as re-authentication identities.
(However, 3GPP decided to use the same format for both types of identities in release 6 specifications.)
 
Regards,
Henry 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of ext Thomas Wieland
Sent: 06 April, 2005 10:41
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]; Haverinen Henry (Nokia-ES/Jyvaskyla)
Subject: Re: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

  I'm not an author but "other people", but maybe I can shed 
some light on this.  Henry can always correct and expand.

There is nothing "wrong" with the identities used during full
authentication (i.e. either permanent identity, e.g. 1IMSI @realm,
or pseudonym identity).  The "problem", if you will, is that by
definition of a full authentication, these identities require the
use of 2 or 3 GSM triplets to authenticate.  

The second "bad" aspect is that each full EAP-SIM authentication uses 
up 2 or 3 triplets.  The number of triplets that can be generated by each 
SIM is usually limited (e.g. to 50,000) due to security concerns.  This 
doesn't matter too much in a GSM mobile network as authentications
only use only one triplet and occur relatively infrequently compared to,
for example, public WLAN.  For EAP-SIM used in a PWLAN scenario,
not only do you use up 2 or 3 triplets per authentication, the authentications 
also happen much more frequently.  For example every time every time 
a PC gets turned on (or woken up), when a user roams between access
points etc.  You can see how you could be chewing through the available
triplets pretty fast and once you've reached the limit hard-wired into the
SIM, your SIM is dead and needs to be replaced.  

By using the fast re-auth mechanism, not only do you speed up 
EAP-SIM authentications (hence "fast" :-), you also reduce the
load on the back-end server (AuC) and extend the life of your SIM.
In other words, "it's a good thing".

Regards,

  Thomas

Hi, 

Thanks in advance,

Madjid Nakhjiri

_______________________________________________ eap mailing list [email-masked] http://mail.frascone.com/mailman/listinfo/eap

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 6 Apr 2005 14:19:02 -0500

Hi Thomas,

Thanks for being among helpful "other people" :-)

Ok, I am not sure how fast re-authentication protects the use identity, so I can understand if no protection is provided, that would be one way to protect the permanent identities such as IMSI.

But what I don't understand is how every use of IMSI means use of new triplets?

Sure EAP-SIM draft says that it does not allow re-use of triplets (I guess for full authentication), but from what I understand the fast re-authentication does not use any triplets, so the question of "re-use versus using fresh" should be moot.

I do have another issue with the fast re-auth. Most of the sequence charts only show a peer and an authenticator. Does this mean the authenticator is the NAS or that it is the EAP server? I am trying to understand how this fits into a 3 party EAP authentication model and whether the fast re-authentication can apply to handovers or it is just re-authentication to the same authenticator?

Regards,

Madjid

-----Original Message-----
From: Thomas Wieland [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 2:41 AM
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]; [email-masked]
Subject: Re: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

  Thomas

Hi, 

Thanks in advance,

Madjid Nakhjiri

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 6 Apr 2005 14:50:40 -0500

Hi Henry,

Thank you for sending a quick response. I don't have an issue with having a fast re-authentication method that is more lightweight than the full authentication as long as the security is not compromised. One thing I am not clear about is whether the procedure is intended for handovers or not. But that is a different issue. The point I was trying to understand is not why fast re-authentication is needed, it is why a different identity is being used. Please see inline.

Regards,

Madjid

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 3:34 AM
To: [email-masked]; Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Madjid, Thomas,

separately, more modularly, at the server. 

Madjid>>Can't both modules use the same identity for the peer? I am guessing for fast re-auth you need to locate the MK, can't you do it with the same identity as the one you used for full authentication?

When the server runs fast re-authentication, it does not have 

Madjid>> why do you need the triplets for fast re-authentication. Isn't the user id and MK enough?

Madjid>>Couldn't this be done with the same identity by some sort of flag or subtype? 

not stored so "reliably". 

Madjid>> I guess it depends on how fast re-auth ID is created/ communicated to the local server.

I am guessing fast re-auth ID is generated after a full authentication with a perm. ID is performed and the master key is sent from the central server to the local server. If the MK is sent to the local server processing the fast re-auth, why not send the perm. ID with it? Unless you want to protect the perm. ID from the local server?

For example, some EAP-SIM server implementations use cryptographically generated

Regards,

Henry 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of ext Thomas Wieland
Sent: 06 April, 2005 10:41
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]; Haverinen Henry (Nokia-ES/Jyvaskyla)
Subject: Re: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

  Thomas

Hi, 

Thanks in advance,

Madjid Nakhjiri

---

From: <[email-masked]>
Date: Mon, 11 Apr 2005 11:45:29 +0300

Hi Madjid,
 
The term "EAP server" simply refers to the entity that implemens
the EAP-SIM server part. Usually this is implemented in a AAA server.
The "authenticator" is a term that EAP documents use for the first-hop entity
(NAS or 802.11 access point). In principle, the EAP server could be
co-located in the NAS, but I don't think this is likely in the case of EAP-SIM.
 
If the access technology requires an EAP exhange upon a handover, 
then you can run either mode  of EAP-SIM there (full or fast re-auth).
Unless pre-authentication is used, this kind of handover is not likely to be
very smooth. If there is a need to run an EAP exchange even through 
you haven't moved to a new AP, you can also run either mode. 
EAP-SIM does not define when to use the fast re-auth mode.
 
Regards,
Henry

-----Original Message-----
From: ext Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
Sent: 06 April, 2005 22:19
To: 'Thomas Wieland'
Cc: [email-masked]; Haverinen Henry (Nokia-ES/Jyvaskyla); Nakhjiri Madjid-MNAKHJI1
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Thomas,

Regards,

Madjid

-----Original Message-----
From: Thomas Wieland [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 2:41 AM
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]; [email-masked]
Subject: Re: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

  Thomas

Hi, 

Thanks in advance,

Madjid Nakhjiri

---

From: <[email-masked]>
Date: Mon, 11 Apr 2005 11:55:22 +0300

Hi Madjid,
 
Please see in line.

-----Original Message-----

Yes, if we had designed the protocol differently :-) 

This all relates to the management of temporary identities. If you want to use

a separate identity upon each EAP exchange, and if you perform a full authentication

after a fast re-authentication, then the last temporary identity that you distributed

during fast re-authentication would have to be available to the module that

performs full authentication.

You don't need triplets for fast re-authentication. The fast-reauthentication id, the

counter, and the MK are enough.

Yes. In this procol, we did it with a separate identity.

As said, this relates to the use of temporary identities, which are used instead of the permanent identity

for privacy reasons.  If there were scenarios where fast re-authentication would be distributed closer to 

the access network (which I am not aware of, BTW ), and if you want to use temporary identities, then

it is better to have a separate identity "space" for the local server to administer -- just as we 

have currently in EAP-SIM. 

EAP-SIM does not allow the use of the permanent identity upon fast re-authentication. This

is not a problem, since the server needs to keep state anyway, so the identity can

be managed as part of the other state.

Regards,

Henry

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Tue, 12 Apr 2005 14:18:05 -0500

Hi Henry,

I understand that most of EAP methods are designed for both 2- and 3 party models. However, I do think the EAP master key from EAP authentication only resides at the peer and the EAP server and so far we are ok for both 2 and 3 party models. Now if you choose to implement a key distribution based on the initial EAP authentication, you can choose to send your master key to the NAS. I am ok with that too, as long as you are not doing handovers. If you ARE doing handovers, then the master key should not be sent to the NAS, because then after the handover both NAS will come to share the same master key and if the idea is to use the master key to run a security association protocol (such as a 4-way handshake) to arrive at peer-NAS temp keys, then you will have a serious threat problem. 

The fast re-authentication in this draft seems to use the initial master key to derive temp session keys (section 5.1). So based on what I said above, I am assuming it is the EAP server is the one who keeps the master key (EAP server or NAS) and derives the temp keys would be important in case fast re-authentication is used for handovers. So fast re-authentication still needs to happen based on interaction with the EAP server, even though you don't run all the initial EAP exchanges, correct?

Regards,

Madjid

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, April 11, 2005 3:45 AM
To: Nakhjiri Madjid-MNAKHJI1; [email-masked]
Cc: [email-masked]
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

Henry

-----Original Message-----
From: ext Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
Sent: 06 April, 2005 22:19
To: 'Thomas Wieland'
Cc: [email-masked]; Haverinen Henry (Nokia-ES/Jyvaskyla); Nakhjiri Madjid-MNAKHJI1
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Thomas,

Regards,

Madjid

-----Original Message-----
From: Thomas Wieland [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 2:41 AM
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]; [email-masked]
Subject: Re: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

  Thomas

Hi, 

Thanks in advance,

Madjid Nakhjiri

---

From: <[email-masked]>
Date: Thu, 14 Apr 2005 16:47:36 +0300

Hi Madjid,
 
Yes, you are correct. The fast re-authentication exchange is performed by the same 
conceptual EAP server that performs the full authentication exchange. The EAP-SIM document 
or 3GPP WLAN IW documents do not have any provisions for distributing or delegating
fast handoffs outside the home network. So the master key is never sent to the NAS.
 
The fast re-authentication exchange was not designed for fast handoffs. The main
reason is to have a less expensive procedure for frequent re-authentications. 
 
Regards,
Henry

-----Original Message-----
From: ext Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
Sent: 12 April, 2005 22:18
To: Haverinen Henry (Nokia-ES/Jyvaskyla); [email-masked]
Cc: [email-masked]
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Henry,

Regards,

Madjid

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, April 11, 2005 3:45 AM
To: Nakhjiri Madjid-MNAKHJI1; [email-masked]
Cc: [email-masked]
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

Henry

-----Original Message-----
From: ext Nakhjiri Madjid-MNAKHJI1 [mailto:[email-masked]]
Sent: 06 April, 2005 22:19
To: 'Thomas Wieland'
Cc: [email-masked]; Haverinen Henry (Nokia-ES/Jyvaskyla); Nakhjiri Madjid-MNAKHJI1
Subject: RE: [eap] EAP-SIM fast re-auth identity

Hi Thomas,

Regards,

Madjid

-----Original Message-----
From: Thomas Wieland [mailto:[email-masked]] 
Sent: Wednesday, April 06, 2005 2:41 AM
To: Nakhjiri Madjid-MNAKHJI1
Cc: [email-masked]; [email-masked]
Subject: Re: [eap] EAP-SIM fast re-auth identity

Hi Madjid,

Regards,

  Thomas

Hi, 

Thanks in advance,

Madjid Nakhjiri