Subject: [eap] Suggested work item for EAP WG Charter

From: [email-masked] (Walker, Jesse)
Date: Sat, 2 Mar 2002 10:22:09 -0800

Barnard and John,

Let me suggest a work item to incorporate into the EAP WG charter. This is
the  topic of key distribution.

The most critical issue still confronting IEEE 802.11 TGi is how to
accomplish  dynamic key distribution securely. TGi has done much good work
on how to effect key distribution between the 802.11 access point and
station, but this architecture requires at least one key distribution from
an 802.1X authentication server to the access point. Today this is done
using RADIUS, based on ad hoc  techniques. These techniques cannot securely
distribute a key for its intended  purpose. In particular, existing RADIUS
techniques may be suitable for handing  off a key between the authentication
server and the access point, intended for communication between themselves
alone, but as constituted today they are insecure for transferring a session
key intended for use between the access point  and the station. To become
secure the key handoff has to be enhanced to  incorporate additional
cryptographic state that can be used to provide assurances to all three
parties involved in the transaction. Examples of such state are the
information communicated among the KDC and the communicating parties in the
Needham-Schroeder and Otway-Rees protocols.

As of now IEEE 802.11 TGi has no legitimate forum for this discussion. IEEE
802.11 TGi cannot solve the backend key handoff methodology itself, because
the communication among the backend components is outside its scope. A
second  plausible venue--IEEE 802.1 TGaa, chartered with fixing identified
802.1X problems--also lacks the necessary charter to tackle the backend. On
the other hand, it is infeasible for TGi to finish the design of the
handshake between the  access point and the station without relating this
handshake to the backend key distribution, which cannot be done until it is
defined.

My suggestion is to set this problem as a work item for the EAP WG. What I
have in mind is the EAP WG could define an EAP encapsulation for one or more
three-party key distribution protocols, with an eye toward application
within the 802.1X framework. Handshakes like what TGi is developing would be
incorporated into the EAP three-party protocol, so that key distribution and
confirmation could be dealt with uniformly across multiple environments.
These EAP key distribution methods would not work like existing EAP methods,
as by necessity they require active participation by three parties instead
of two, but such is a  fundamental security requirement for any protocol
that calls for a trusted third  party to distribute a key to be utlized by
two other parties as a session key. The proposal would also ask that EAP
methods exporting keys for securing sessions  to define how they use the EAP
key distribution methods, so proper security analysis can verify the
distributed keys can be traced as authorized by the EAP authentication, at
least when used in 802.1X-like environments.

My fear is that if we do not find a venue for this work, we will squander
all the  valuable work that IEEE 802.11 TGi has done to rectify WEP's
deficiencies, and  802.11 security will remain no better than the tarball
the 1999 version of the  802.11 standard has bequeathed us. The EAP WG seems
a natural home for it. Please  consider including this work in the EAP
charter, and let me know if there is  anything I can do to help achieve this
goal.

-- Jesse Walker

---

From: [email-masked] (Bill Arbaugh)
Date: Sat, 02 Mar 2002 14:48:46 -0500

Jesse,

I think this makes a great deal of sense.

Bill

---

From: [email-masked] (Bernard Aboba)
Date: Sat, 2 Mar 2002 12:27:30 -0800 (PST)

Would you be willing/able to make a presentation to the EAP BOF at IETF
53, in order to outline the work that you feel needs to be taken on and
why? 

Some questions to answer in your presentation:

a. Are you advocating that EAP itself incorporate rekeying functionality,
rather than having this done within the 802.1X layer? 

b. Are you advocating standardization of RADIUS AVPs for key
distribution? or are you advocating development of a new EAP method? Or
something else?

c. Are there specific security weaknesses in EAP and RADIUS that you feel
need to be addressed? 

d. Are the problems you are trying to solve only relevant to 802.11, or
could they conceivably be relevant to use with other media as well?

---

From: [email-masked] (Bernard Aboba)
Date: Sat, 2 Mar 2002 13:55:06 -0800 (PST)

I should also mention that there is already an IETF WG that is chartered
for backend authentication server work -- AAA WG. At IETF 52 there was
discussion on the NASREQ Keying AVPs. If I understand your argument below,
it is that use of these AVPs is inappropriate and should be reconsidered. 

You might take a look at:

http://www.drizzle.com/~aboba/AAA/draft-ietf-aaa-diameter-nasreq-09.txt
For a description of the keying functionality.

---

From: [email-masked] (Glen Zorn)
Date: Sun, 3 Mar 2002 03:17:40 -0800

Walker, Jesse [mailto://[email-masked]] writes:

> distribute a key for its intended  purpose.

It's not at all clear to me that this is true.

> In particular, existing RADIUS
> parties involved in the transaction.

Please explain why you think that this is so, and if it is, why this
communication is not coming from the chair of TGi.  I ask this because I,
for one, am unaware of any discussion within TGi taht even imply that this
is a requirement.  Given that the AS and AP trust each other (assumed), why
is a reasonable cryptographic protocol (such as CMS or even IPSec) is
insufficient to protect the transfer of a STA-AP session key from the AS to
the AP?

> Examples of such state are the
> the communication among the backend components is outside its scope.

Yes, and it's not even clear that this is requiredA
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>