Subject: RE: [eap] Issue: Use of term lower layer

From: "Salowey, Joe" <[email-masked]>
Date: Wed, 14 Dec 2005 12:04:19 -0800

> 
> "In order to preserve the security of keys derived within EAP 
> methods, EAP keying material or parameters passed down to a 
> lower layer are for the exclusive use of that lower layer. 
> This prevents compromise of one lower layer from compromising 
> other applications using EAP keying parameters.
> 
> EAP keying material and parameters provided to a lower layer 
> MUST NOT be transported to another entity. The same applies 
> to other keying material derived from the EAP keying 
> material, if the EAP keying material can be computed from the 
> other material without breaking some cryptographic 
> assumption, such as inverting a one-way function. For 
> example, MSK passed down to the EAP peer lower layer or 
> transported to the authenticator MUST NOT leave the peer. "
> 
[Joe] OK, but do we need to restrict parameters?  It seems that there
are some parameters that may be used in a security association
negotiation between peer and authentication.

> --Jari
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: Jari Arkko <[email-masked]>
Date: Wed, 14 Dec 2005 22:29:42 +0200

>negotiation between peer and authentication.
Perhaps. I can agree that we should have the same
restrictions for parameters (as did the original text).
I just get a bit worried that we don't define the parameters.
When we say, e.g., MSK, we know exactly what we mean.

--Jari