Subject: [HOKEY] EMSKname in keyName-NAI

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 20 Feb 2008 15:12:32 -0500

I have two questions on EMSKname in keyName-NAI in draft-ietf-hokey-erx-11.txt:

"
  keyName-NAI - ERP messages are integrity protected with the rIK or
  the DS-rIK.  The use of rIK or DS-rIK for integrity protection of
  ERP messages is indicated by the EMSKname [3], the protocol, which
  is ERP, and the realm, which indicates the domainname of the ER
  server.  The EMSKname is copied into the username part of the NAI.
"

- What is the exact format of EMSKname ?  I could not fined an EMSK
name definition in [3].  

- Does the format of EMSKname (if specified somewhere) follow the NAI
format defined in RFC 4282?

Best Regards,
Yoshihiro Ohba
_______________________________________________
HOKEY mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/hokey

---

From: Lakshminath Dondeti <[email-masked]>
Date: Wed, 20 Feb 2008 12:21:43 -0800

> - What is the exact format of EMSKname ?  I could not fined an EMSK

It's in a revision that Joe is going to submit shortly.

> format defined in RFC 4282.

EMSKname is a 64-bit key identifier.
EMSKname = SHA-256-64(EAP Session ID, "EMSK")

thanks,
Lakshminath

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 20 Feb 2008 12:23:30 -0800

Hi Yoshihiro,

We are currently editing the draft to include EMSKName.  The name will
be derived similar to the following:

EMSKname = SHA-256-64 ( EAP Session-ID | "EMSK" )

This name is a 64-bit binary string.  In order to use this in an NAI it
would need to be encoded into a character set that is usable in an NAI.

I think the ERX draft should define the NAI encoding of the EMSKname.
Perhaps a straight binary to lowercase ASCII hex encoding would be
simplest.  

Joe

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Yoshihiro Ohba
> Sent: Wednesday, February 20, 2008 12:13 PM
> To: [email-masked]
> Subject: [HOKEY] EMSKname in keyName-NAI
> 
> - What is the exact format of EMSKname ?  I could not fined 
> an EMSK name definition in [3].  
> 
> - Does the format of EMSKname (if specified somewhere) follow 
> the NAI format defined in RFC 4282?
> 
> Best Regards,
> Yoshihiro Ohba

---

From: Lakshminath Dondeti <[email-masked]>
Date: Wed, 20 Feb 2008 12:26:19 -0800

> Perhaps a straight binary to lowercase ASCII hex encoding would be

And we did just that.

Lakshminath

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 20 Feb 2008 15:36:35 -0500

> EMSKname = SHA-256-64(EAP Session ID, "EMSK")

What happens if the resulting SHA-256-64 output contains an ASCII control
characters such as a null character?

Yoshihiro Ohba

---

From: Lakshminath Dondeti <[email-masked]>
Date: Wed, 20 Feb 2008 12:39:06 -0800

> characters such as a null character?

Good question.  Pasi asked that before and as Joe also pointed out 
suggested using Hex encoding and that's what we have now.

regards,
Lakshminath

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 20 Feb 2008 15:40:33 -0500

> Perhaps a straight binary to lowercase ASCII hex encoding would be

Or just use base64?

Yoshihiro Ohba