Subject: Re: [kitten] Right place for ABFAB ephemeral keying

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 15 Nov 2013 14:01:13 -0500

On Fri, 2013-11-15 at 13:25 -0500, Sam Hartman wrote:

> my conclusion from all this is that the right place to do ephemeral
> keying for an EAP protocol is in the lower layer and that unless I got
> something wrong or missed an alternative, ABFAb should do its own
> mechanism.
> 
> Can anyone see a good way to get protocol re-use here?

I'm a little confused at this point about what the protocol stack looks
like and where you want ephemeral keying.  However, we've certainly had
conversations in the past about adding wrap/MIC support and/or PFS to
GSS mechanisms by using a stackable wrapper mech that does a DH
exchange, authenticates it using the wrapped mech, and then uses the
shared secret to provide per-message services.

It seems like you could go a step further and also protect the wrapped
mech's context establishment tokens.  Of course, that would not hide the
context establishment from an active MitM, but if done correctly, it
would allow you to discover the MitM's presence before you use the
resulting context for anything.

-- Jeff