Subject: RE: [Mip6] Security Section Commentsondraft-ietf-mip6-bootstrap-ps-01.txt

From: "Alpesh" <[email-masked]>
Date: Thu, 3 Mar 2005 14:24:17 -0800

James,

I am fine with the later suggestion. In the last line, I think you mean to
say:
 
"... , including if the keys are generated from "same" authentication
credentials"

-a

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of James Kempf
> Sent: Friday, February 25, 2005 9:09 AM
> To: Yoshihiro Ohba; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Mip6] Security Section 
> Commentsondraft-ietf-mip6-bootstrap-ps-01.txt
> 
> Yoshi,
> 
> If the two sides use Diffie-Hellman, then the keys won't be 
> generated directly from authentication credentials. The 
> Diffie-Hellman exponents don't need to be related to 
> authentication credentials at all.
> 
> Instead of:
> 
> "As mobility and network access authentication are seperate 
> services, keys generated from authentication credentials for 
> these services need to be cryptographically seperate, 
> seperately named and have seperate lifetimes."
> 
> How about:
> 
> "As mobility and network access authentication are separate 
> services, keys generated for these services need to be 
> cryptographically separate, separately named, and have 
> separate lifetimes, including if the keys are generated from 
> authentication credentials"
> 
> This doesn't imply somehow that the keys will always be 
> generated from authentication credentials.
> 
>             jak
> 
> 
> ----- Original Message -----
> From: "Yoshihiro Ohba" <[email-masked]>
> To: <[email-masked]>
> Cc: <[email-masked]>; <[email-masked]>; 
> <[email-masked]>
> Sent: Friday, February 25, 2005 5:57 AM
> Subject: Re: [Mip6] Security Section Comments 
> ondraft-ietf-mip6-bootstrap-ps-01.txt
> 
> 
> > On Fri, Feb 25, 2005 at 08:02:02AM +0200, 
> [email-masked] wrote:
> > > I agree with James on this.  Yoshi - do you think the current text
> prevents
> > > both the network access & mobility service from sharing 
> the same EAP
> master key?
> >
> > I am not sure whether the current text prevents it or not, but it
> > would be clearer if we can mention that the keys that need to be
> > cryptographically separated are generated from authentication
> > credentials (i.e., are not the keys in the authentication
> > credentials), something like:
> >
> > "
> >  In addition to these attackes, there are other considerstions that
> >  are important in achieving a good security design. As mobility and
> >  network access authentication are seperate services, keys generated
> >  from authentication credentials for these services need to be
> >  cryptographically seperate, seperately named and have seperate
> >  lifetimes. This is needed because if one service is 
> compromised, the
> >  other service is not. This is necessary so that a mobile host can
> >  move from one serving (or roaming) network access provider 
> to another
> >  without needing to change its mobility access provider. Finally,
> >  basic cryptographic processes must provide for multiple 
> algorithms in
> >  order to accommodate the widely varying deployment needs.
> > "
> >
> > Regards,
> >
> > Yoshihiro Ohba
> >
> >
> > >
> > > John
> > >
> > > > -----Original Message-----
> > > > From: ext James Kempf [mailto:[email-masked]]
> > > > Sent: 24 February, 2005 20:42
> > > > To: Yoshihiro Ohba; Loughney John (Nokia-NRC/Helsinki)
> > > > Cc: [email-masked]
> > > > Subject: Re: [Mip6] Security Section Comments
> > > > ondraft-ietf-mip6-bootstrap-ps-01.txt
> > > >
> > > >
> > > > Yoshi,
> > > >
> > > > This works if EAP is used, but it might not be. From the
> > > > perspective of the
> > > > problem statement, I think it is sufficient to state that the
> > > > keys need to
> > > > be cryptographically separated. In the solutions document,
> > > > this then can be
> > > > addressed in a way appropriate to the solution.
> > > >
> > > >             jak
> > > >
> > > >
> > > >
> > > > ----- Original Message ----- 
> > > > From: "Yoshihiro Ohba" <[email-masked]>
> > > > To: <[email-masked]>
> > > > Cc: <[email-masked]>; <[email-masked]>
> > > > Sent: Wednesday, February 23, 2005 4:41 PM
> > > > Subject: Re: [Mip6] Security Section Comments
> > > > ondraft-ietf-mip6-bootstrap-ps-01.txt
> > > >
> > > >
> > > > > Hi John and James,
> > > > >
> > > > > I think that we might define which level of the keys 
> for the two
> > > > > services in the EAP key hierarchy needs to be 
> cryptographically
> > > > > separated (for simplicity let me assume that the keys are part
> > > > > of EAP key hierarchy).
> > > > >
> > > > > It is always good to cryptographically separate keys
> > > > derived from the
> > > > > EAP MK (Master Key) for network access service and 
> keys derived from
> > > > > the EAP MK for mobility service.  On the other hand, 
> depending on
> > > > > optimization level and deployment scneario, two EAP 
> MKs may be the
> > > > > same, meaning that cryptographic separation may not always
> > > > be possible
> > > > > at the highest level of the EAP key hierarchy.
> > > > >
> > > > > Yoshihiro Ohba
> > > > >
> > > > >
> > > > >
> > > > > On Wed, Feb 23, 2005 at 07:23:16AM +0200,
> > > > [email-masked] wrote:
> > > > > > Hi James,
> > > > > >
> > > > > > > Actually, I think we want to keep the keys 
> separate even if the
> > > > network
> > > > > > > access provider and mobility service provider are the
> > > > same. From a
> > > > security
> > > > > > > standpoint, it makes sense to maintain separate keys,
> > > > so that if one
> > > > is
> > > > > > > compromised the other won't be.  I suppose one could
> > > > argue that "well,
> > > > if
> > > > > > > the network access service is compromised, the user is
> > > > so hosed, so it
> > > > > > > really doesn't matter if mobility service is
> > > > compromised" but the othe
> > > > way
> > > > > > > around is something different. If the mobility 
> service key is
> > > > compromised,
> > > > > > > the mobile host could stay put at the same place and
> > > > re-establish
> > > > secure
> > > > > > > mobility access service, as long as network access
> > > > service is not
> > > > > > > compromised. If the two keys are the same, then the
> > > > mobile host must
> > > > go
> > > > > > > through re-establishing secure network access service
> > > > before mobility
> > > > > > > service security can be repaired.
> > > > > > >
> > > > > > > Does this make sense? If so, perhaps the draft should
> > > > make this point
> > > > > > > explicitly.
> > > > > >
> > > > > > I think we should make this point explicitly.  To modify
> > > > your proposed
> > > > text:
> > > > > >
> > > > > > >> In addition to these attacks, there are other
> > > > considerations that are
> > > > > > >> important in achieving a good security design. Because
> > > > mobility and
> > > > network
> > > > > > >> access authentication are separate services, any 
> keys for these
> > > > services
> > > > > > >> need to be cryptographically separate, separately
> > > > named, and have
> > > > separate
> > > > > > >> lifetimes that are not exceeded. This is necessary
> > > > because a mobile
> > > > host
> > > > > > >> must be able to move from one serving (or roaming)
> > > > network access
> > > > provider
> > > > > > >> to another without needing to change its mobility
> > > > access provider.
> > > > Finally,
> > > > > > >> basic cryptographic processes must provide for
> > > > multiple algorithms in
> > > > order
> > > > > > >> to accommodate the widely varying deployment needs.
> > > > > >
> > > > > >  In addition to these attackes, there are other
> > > > considerstions that are
> > > > important
> > > > > >  in achieving a good security design. As mobility and
> > > > network access
> > > > authentication
> > > > > >  are seperate services, keys for these services need to be
> > > > cryptographically
> > > > > >  seperate, seperately named and have seperate lifetimes.
> > > > This is needed
> > > > because
> > > > > >  if one service is compromised, the other service 
> is not. This is
> > > > necessary
> > > > > >  so that a mobile host can move from one serving (or
> > > > roaming) network
> > > > access
> > > > > >  provider to another without needing to change its 
> mobility access
> > > > provider.
> > > > > >  Finally, basic cryptographic processes must 
> provide for multiple
> > > > algorithms in order
> > > > > >  to accommodate the widely varying deployment needs.
> > > > > >
> > > > > > John
> > > > > >
> > > > > > _______________________________________________
> > > > > > Mip6 mailing list
> > > > > > [email-masked]
> > > > > > https://www1.ietf.org/mailman/listinfo/mip6
> > > > >
> > > >
> > > >
> > > >
> >
> 
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Thu, 3 Mar 2005 14:26:32 -0800

Yes.

            jak

----- Original Message ----- 
From: "Alpesh" <[email-masked]>
To: "'James Kempf'" <[email-masked]>; "'Yoshihiro Ohba'"
<[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Thursday, March 03, 2005 2:24 PM
Subject: RE: [Mip6] Security Section
Commentsondraft-ietf-mip6-bootstrap-ps-01.txt