Subject: [eap] PKMv2 EAP Authenctication

From: Rengith Thomas <[email-masked]>
Date: Wed, 7 Mar 2007 15:09:05 +0530

Hi All,

I was seeing the feasiblity of using IEEE 802.1x  EPOL code for handling 
the 
PKMv2 Eap authentication.

MY network model is as given below.
 
EAP-method                                         EAP-method
EAP                           EAP   EAP              EAP EAP   EAP
PKMv2                      PKMv2 ???            ??? RADIUS     RADIUS
------------                    ------------ -------------------------     
             -----------
MSS/EAP_peer    BS/EAP_Proxy     Gateway/EAP_Authenticator     AS

The link between BS and MS is wireless using 802.16e(Wibro)
BS acts as a relay agnet and having functionality.
 1. On uplink BS removes EAP pdus from the PKMv2 encapsulation, 
encapsulates the EAP and then send the packet using 
     auth relay protocol to authencticator which is a RADIUS client.
 
 2. On downlink BS removes EAP pdus from a proprietary protocol  
encapsulation,
encapsulates them in PKMv2 and    forwards them to the MSS

Can u just give me some idea how to implement the Authentication process 
in each networking entity.
Mostly regarding the key implemantaion.

MSK(master session Key),?
Who and how to generate  PMK and AK?

Regards,
Rengith Thomas

***********************  Aricent-Private   ***********************
"DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of 
the individual to whom it is addressed. It may contain privileged or confidential information and should not be 
circulated or used for any purpose other than for what it is intended. If you have received this message in error, 
please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly
prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for 
loss or damage arising from the use of the information transmitted by this email including damage from virus."
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 07 Mar 2007 08:04:55 -0800

IEEE 802.16e does not support IEEE 802.1X authentication, because with 
802.16 (like PPP), authentication is required prior to bringing the link up. 
  Therefore EAP packets encapsulated in a dataframe prior to "link up" will 
be dropped.

>I was seeing the feasiblity of using IEEE 802.1x  EAPOL code for handling
>the PKMv2 Eap authentication.

---

From: Rengith Thomas <[email-masked]>
Date: Thu, 8 Mar 2007 10:58:24 +0530

Dear Bernard,

          Thanks for the prompt reply.
           Can you please give some  more input for the Authenticator Key 
handling part.
           The whole n/w is like this ( MS <--> BS 
<-->Authenticator<-->AAA)
 
            AKA                 AKA
            EAP                           EAP   EAP EAP   EAP     EAP 
            PKMv2                      PKMv2 ???                      ??? 
RADIUS                                     RADIUS 
            ------------                    ------------  
-------------------------                                  ----------- 
          MSS/EAP_peer      BS/EAP_Proxy         Gateway/EAP_Authenticator 
          AAA server 

        From  Wimax forum studies of PKMv2 , during initial network entry 
sequence , it says about 
      the  generation of keys.The  PMK(Pairwise Master key) key generated 
using MSK(Master Session key)
        and AK(authorization key) generated in authenticator and MS using 
PMK key.

         So can you please provide some information about the Key handling 
part in each network entity.

Regards,
Rengith Thomas

"Bernard Aboba" <[email-masked]> 
03/07/2007 09:34 PM

To
Rengith Thomas/CHE/HSS@HSS, [email-masked]
cc

Subject
RE: PKMv2 EAP Authenctication

IEEE 802.16e does not support IEEE 802.1X authentication, because with 
802.16 (like PPP), authentication is required prior to bringing the link 
up. 
  Therefore EAP packets encapsulated in a dataframe prior to "link up" 
will 
be dropped.

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 07 Mar 2007 22:35:55 -0800

>So can you please provide some information about the Key handling part in 
>each network entity.

I believe this is covered in the IEEE 802.16e-2005 specification, which is 
available for download here:
http://standards.ieee.org/getieee802/802.16.html

---

From: Rengith Thomas <[email-masked]>
Date: Fri, 9 Mar 2007 12:43:08 +0530

Dear Bernard,

We need to implement a pass through authenticator. RFC 4137 explains the 
state machine implementation of RFC 3748.  So while designing 
Gateway/EAP_Authenticator, Whether we have to stick to IEE 802.1X state 
machines with some changes or RFC 4137 state machine (decision = 
PASSTHROUGH). 

The  n/w is like this ( MS <--> BS <-->Authenticator<-->AAA) 
            
            AKA                                                           
                                                                          
 AKA
           EAP                           EAP   EAP                       
EAP   EAP                                         EAP 
           PKMv2                      PKMv2 ???                      ??? 
RADIUS                                     RADIUS 
           ------------                    ------------                   
     -------------------------                                 
 ----------- 
         MSS/EAP_peer      BS/EAP_Proxy         Gateway/EAP_Authenticator 
          AAA server 

Your views will be very helpful for our design. Thanks in advance

Regards,
Rengith Thomas

03/08/2007 12:05 PM

To
Rengith Thomas/CHE/HSS@HSS
cc
[email-masked]
Subject
Re: [eap] PKMv2 EAP Authenctication

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 09 Mar 2007 06:39:02 -0800

>machines with some changes or RFC 4137 state machine (decision =

I can't answer your question because the IEEE 802.16e specification does not 
indicate how 16e interfaces with the EAP state machine described in RFC 
4137.

When we did the IEEE 802.16e security review, we noted the lack of a state 
machine, and flagged this as a security concern.   We were told that future 
updates to 16e would provide this information.

I have doubts whether the IEEE 802.1X state machine is applicable, because 
16e begins the interaction with EAP before dataframes can be sent.  If you 
are looking for a place to start, the PPP state machine might be closer, 
since in both 16e and PPP, EAP authentication occurs prior to "Link Up", not 
after, as it does with IEEE 802.1X.

---

From: Rengith Thomas <[email-masked]>
Date: Wed, 14 Mar 2007 10:38:07 +0530

Dear Bernard,

Thank you  for the valuable information.One more doubt i have related to 
the Link Status. 
 If I am making Link state UP explicitly while creating the port , then 
can i use  the   IEEE 802.1X state machine.(some time constraints i have 
force full to use  802.1x code). Whether this change will  affect any 
authentication procedure in PKMv2 based authentication.

>I have doubts whether the IEEE 802.1X state machine is applicable, 
because 16e begins 
>the interaction with EAP before dataframes can be sent. If you are 
looking for a place to start, 
>the PPP state machine might be closer, since in both 16e and PPP,
> EAP authentication occurs prior to "Link Up", not after, as it does with 
IEEE 802.1X.

Regards,
Rengith Thomas

To