Subject: RE: [Pana] review of the pana protocol

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 5 Feb 2004 11:03:03 +0100

hi jari, 

i have a question regarding the MSK and AAA-Key. please see my comment
inline:

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]]
> Sent: Thursday, February 05, 2004 9:36 AM
> To: Yoshihiro Ohba
> Cc: [email-masked]
> Subject: Re: [Pana] review of the pana protocol
> 
> 
> Yoshihiro Ohba wrote:
> > I have one question to Jari on the definition of MSK (please
> > see my comments below).
> 
> >    Master Session Key (MSK)
> > 
> >         Keying material (at least 64 octets) that is derived between
> >         the EAP client and server and exported by the EAP method.
> > "
> > 
> > OHBA: Is the definition (copied from 
> draft-ietf-eap-keying-01.txt) of
> > MSK correct?  I am a bit confused about the distinction between MSK
> > and AAA-Key.
> 
> 
> The definition is right. But there is a question of whether you
> should actually use AAA-Key and not MSK.
> 
> The difference between the MSK and the AAA-Key is that the MSK
> is held by the EAP server i.e. an AAA node, whereas the AAA-Key
> is the value that is communicated to the actual authenticator
> i.e. PAA. So from this it is pretty clear that your draft should
> really talk about the AAA-Key. On the other hand, while different
> designs have been discussed in the EAP WG, in 802.11i the AAA-Key
> is octets 0-31 of the MSK.

it is said that the AAA-Key is derived from the MSK and EMSK. 

the eap-keying document does not specify how this key derivation is
achieved. 
worse, in Section 4.2.1 the text says: 

"  The AAA-Key is derived from the keying material exported by the EAP
   method (MSK and EMSK).  This derivation occurs on the AAA server.  In
   many existing protocols that use EAP, the AAA-Key and MSK are
   equivalent, but more complicated mechanisms are possible (see
   Appendix E for details).
"

appendix e, however, does not help since it talks only about a very special
case, namely fast handoff. 

in our eap keying design team phone conferences i suggested to have
something standardized here and that the document 
(i guess i also included this issue in my comments for the eap-keying
draft). 

unfortunately, i never got a single comment. i personally think that example
key derivation procedures, as for example shown in appendix E, etc. do not
really help. instead it would be more helpful to offer one mechanism which
should be used. 

i personally think that this is somewhat vague and should be specified since
the EAP peer and the Authenticator are supposed to end up with the same key
after the EAP protocol exchange is finished.

ciao
hannes

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 05 Feb 2004 08:26:31 -0800

I think Hannes' point is valid.  Since eap keying draft made a distinction 
between AAA-Key and MSK, it should be the responsibility of the keying draft 
to define an algorithm to unambiguously calculate AAA-Key from MSK.

I think we can simply:

- Replace "MSK" in the PANA specification draft with "AAA-Key"

and

- Ask EAP Keying design team to define an algorithm (or algorithms,
  one per usage case?) to derive AAA-Key from MSK.

Note that the same thing would also apply to pana-ipsec draft.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 05 Feb 2004 08:26:31 -0800

I think we can simply:

and

Yoshihiro Ohba