Subject: [eap] Proposed resolution to Issue 327: PANA and the EAP Key management framework

From: "Bernard Aboba" <[email-masked]>
Date: Sun, 22 Jan 2006 21:23:18 -0800

The text of Issue 327 is enclosed below.

The intent of Section 2.3 is to review use of EAP within documents that have 
already been published.   PANA is still under review, and it appears that 
there are a number of issues that still need to be ironed out.  Therefore, 
I'd suggest that we omit discussion of PANA in this document.

----------------------------------------------------------------------------------------------------------------------
Issue 327: PANA and EAP Keying Framework
Submitter name: Yoshihro Ohba
Submitter email address: [email-masked]
Date Submitted: January 9, 2006
Reference: http://lists.frascone.com/pipermail/eap/msg03860.html
Document: Keying-08
Comment type: T
Priority: 1
Section: 2.3
Rationale/Explanation of issue:
It would be useful to add some
description on how PANA handle the caching of EAP keying material and
the generation of transient session keys.

Requested change:

Add the following description in Section 2.3:

"PANA

     PANA [I-D.ietf-pana-pana] supports caching of the MSK, but not
     the EMSK, IV, Session-ID, Peer-ID or Server-ID.  In the PANA
     model [I-D.ietf-pana-framework], TSKs are generated using a
     Secure Association Protocol between the peer and and
     authenticator port (which is referred to as an Enforcement
     Point), where both link-layer specific key exchange protocols and
     IKE can be used as the Secure Association Protocol depending on
     whether link-layer ciphering or IPsec is used between the peer
     and the authenticator port.  The key scope and lifetime of the
     TSKs are communicated from the authenticator to the peer.  The
     key scope is specified as a list of device identifiers of the
     Enforcement Points.  Depending on the Secure Association
     Protocol in use, TSK rekey is possible without EAP
     re-authentication."

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap