Subject: [Mip4] RE: [AAA-WG]: [Issue] Name for the nonces in aaa-keys and diamete r-mip

From: Bernard Aboba <[email-masked]>
Date: Fri, 21 Nov 2003 21:51:23 -0800 (PST)

> In the AAA Keys for Mobile IPv4  draft it is defined as such:
>
> Key Material    Data (e.g., a nonce) used for the purpose of
>                 creating a key.
> In the section for Key Material Creation and Derivation it state that the
> 'Key Material' is a random value.

Typically the term "Key Material" is used to refer to something from which
a Session Key is derived. Both the Keying Material and the Session Key are
secrets.  Is that the case here?

> Does that random value have to be different from previous choices inserted
> in a message to protect against replays?

If replay protection is desired, a counter or other monotonic value will
generally do the job. But "freshness" can be provided a nonce. They aren't
necessarily the same thing (e.g. assuring that a nonce isn't replayed
requires a large cache, while assuring against replay of a counter is
easy).

kk

-- 
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4

---

From: Avi Lior <[email-masked]>
Date: Fri, 21 Nov 2003 23:02:21 -0500

Hi Pete, Bernard,

If you look at RFC 3344 nonce is defined this way:

  A randomly chosen value, different from previous choices,
  inserted in a message to protect against replays.

If this is a correct definition then the proposed usage is not consistant
with the above definition, right?

That is it could be a nonce but it doesn't have to be.

BTW:  If it does have to have propreties consistant with RFC 3344's
definition of nonce, then I suggest that AAA Keys for Mobile IPv4 should be
tightened.

Just my 2cents worth.

BTW I took a look around and I don't have a problem with Key Material  here
is a definition that is common:

Keying Material

The data (e.g., keys and IVs) necessary to establish and maintain
cryptographic keying relationships.

Avi

> -----Original Message-----
> From: Pete McCann [mailto:[email-masked]] 
> Sent: November 21, 2003 1:43 PM
> To: Bernard Aboba
> Cc: [email-masked]; [email-masked]
> Subject: Re: [AAA-WG]: [Issue] Name for the nonces in 
> aaa-keys and diameter-mip
> 
> 
> 
> Hi, Bernard,
> 
> Ok, let's make sure to check the context in each case.
> 
> Also, please note that the only long-term secret required is 
> the one shared between MN and AAAH.  The Diameter-MIP4 
> application can dynamically distribute the MN-HA session key 
> (and the nonce that was used to generated it) to the HA.  You 
> are of course allowed to have a long-term secret between the 
> MN and HA as part of a manually (or
> otherwise) configured mobility security association, but it 
> isn't required.
> 
> -Pete
> 
> Bernard Aboba writes:
>  > This change is ok with me as long as the term "Nonce" 
> refers to a  > non-secret quantity.  It would appears to me 
> that at least some of the  > quantities referred to as "Key 
> Material" in the Diameter MIPv4 draft are  > in fact secret.  > 
>  > Also, I'd prefer to use the term "Session Key" for an 
> ephemeral key that  > is refreshed by a nonce, and 
> "Pre-shared key" for a quantity that is a  > long-term secret 
> (such as that shared between the MN and HA).  > 
>  > Getting the terminology straight is probably half the 
> battle in getting  > these drafts completed.  > 
>  > On Fri, 21 Nov 2003, Pete McCann wrote:
>  > 
>  > >
>  > > Hi,
>  > >
>  > > During my presentation of the Diameter Mobile IPv4 
> application to the  > > AAA working group, an item came up 
> around the use of the term "Key  > > Material" in the 
> Diameter Mobile IPv4 application and the Mobile IP  > > 
> aaa-key draft.  It was noted that the term "Key Material" 
> usually  > > denotes stuff that should be kept secret, 
> whereas the "Key Material"  > > sent in a Registration Reply 
> are actually nonces intended to be used  > > by the MN to 
> derive session keys.  They will be visible to third  > > 
> parties while in transit.  > >  > > To resolve this, I 
> suggest that we change all instances of "Key  > > Material" 
> in both of these drafts to something more descriptive,  > > 
> like "Nonce for Key Generation" or just "Nonce" when the 
> context is  > > clear.  > >  > > Is that acceptable to 
> everyone?  Hopefully we can make this change  > > quickly and 
> get both drafts ready for IESG submission.  > >  > > Thanks,  
> > >  > > -Pete  > >  > >
>

---

From: Pete McCann <[email-masked]>
Date: Sun, 23 Nov 2003 23:50:48 -0600

Hi, Avi,

You could say that the nonces in the "key material" field serve to
make the key fresh, which in turn helps defeat replay attacks using
old keys.  So it is a "value, different from previous choices,
inserted in a message to protect against replays" but it is not
required to be random, and the replay protection is somewhat indirect.

I think the use of the term nonce for this value would be consistent
with existing cryptography literature, even if it may not be
consistent with the definition in 3344, which is really there for the
nonce-based replay protection that is part of the base Mobile IPv4
protocol.

The definition for keying material that you cite shows why we
shouldn't use that term for the nonce value.

-Pete