Subject: [HOKEY] consensus call: key distribution security requirement

From: Charles Clancy <[email-masked]>
Date: Sat, 31 Mar 2007 15:15:58 -0400

HOKEY WG,

The 3-party protocol proposal at IETF 68 listed a variety of protocol 
requirements, some of which went beyond those currently specified in the 
problem statements draft.  The main extension was a requirement for 
stronger key distribution security.

Discussion: The problem statements document currently requires channel 
bindings to allow clients to authenticate the network to which they are 
connecting, and prevent the lying NAS problem.  However one possible 
implementation of channel bindings would allow keys to be distributed 
prior to the network being authenticated by the peer.  While the peer 
may decide to not use a network after it's validated its identity, 
network entities could retain the keying material.  There has been much 
debate on the list as to whether or not network entities could 
maliciously use this keying material, and the intent here is to not 
rehash all that discussion.

Question: Should additional text be added to the problem statement draft 
  to require peer authorization for distributing keying material?

Protocol Implications: If "yes" then a 3-party protocol would be need, 
and would require L2 advertisement of the NAS-ID and local AAA domain 
name.  If "no" then channel bindings where identities are hashed into 
the key derivation would be sufficient.

-- 
t. charles clancy, ph.d.  <>  [email-masked]  <>  www.cs.umd.edu/~clancy

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Charles Clancy <[email-masked]>
Date: Sat, 31 Mar 2007 15:18:08 -0400

... please respond by Friday, April 13.