Subject: [Mobopts] RE: [Mipshop] RE: Review of draft-vidya-mipshop-handover-keys-aaa -00.txt

From: Narayanan Vidya-CVN065 <[email-masked]>
Date: Wed, 20 Jul 2005 21:10:15 -0500

> 
> >>Why does the MN have to use PANA when it uses 802.11i for
> >>network access? Why can't it just use the EAP method with the 
> >>handover key extension during 802.1x?
> >>
> > 
> > 
> > So, in this case, the AAA server will then send the MSK to the AP
> > and the HK to the AR? This is unlike the operation today where the 
> 
> Does the AR need HK in the middle of a handover? Perhaps
> we can do without it.
> Why not let .11r (or something alike) handle 
> re-authentication problem, and assume that AR will forward 
> the packets? At a less critical time, the MN and AR can 
> derive their HK again.
> 

No, the HK is not needed in the middle of a handover. If we piggyback HK derivation on the EAP method as James proposes, it will be derived during handover (unless the MN does another EAP method exchange after handoff sometime). In the currently described protocol, the signaling between MN and AR (and subsequently the AAA server) can happen at any time - not at critical time. So, as you say, 11r or something else will handle the L2 re-auth and the HK itself can be derived before or after handoff (depending on when the MN has information available about the AR). 

In fact, one of the things that will be a problem for us if HK derivation is made dependent on the EAP method is 802.11r - if 11r is adopted as being proposed now with evolving keys, the MN will not perform a full EAP method upon handoff - as long as it is handing off under the same R0 entity, it will only change its PMK-R1/PMK-R2 - hence, the exchange will not reach the AAA server. So, unless the HK itself evolves the same way (which means we now rely on a hierarchy of ARs, with SAs between them, etc.) or we make an assumption that PMK-R0 will always change upon inter-subnet handoffs, it becomes a problem for us. So, I am not entirely sure how we can make L3 handover keys applicable for heterogeneous L2 handoffs (whether L2 employs 802.11i/PANA/802.11r/etc) if the L3 HKs are dependent on L2 authentication. 

> One of the key design goals in FMIP has been to disengage
> all other signaling (e.g., RR, BU, DHCP in fmipv4) from
> the critical path. We should try to preserve that as we
> move along.
> 

Yes, we had this goal as well in designing the protocol. If you look at the 5th bullet in section 1.1, it states this as one of the design goals. 

Regards,
Vidya

> -Rajeev
> 
> 
> 
> > AAA server does not send any keys unsolicited to an entity 
> from which
> >it hasn't received any messages - isn't it?  
> > 
> > _______________________________________________
> > Mipshop mailing list
> > [email-masked] https://www1.ietf.org/mailman/listinfo/mipshop
> 

_______________________________________________
Mobopts mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mobopts

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 21 Jul 2005 11:21:00 -0700

Narayanan Vidya-CVN065 wrote:

> In fact, one of the things that will be a problem for us if 
> HK derivation is made dependent on the EAP method is 802.11r - 
> if 11r is adopted as being proposed now with evolving keys, 
> the MN will not perform a full EAP method upon handoff - as 
> long as it is handing off under the same R0 entity, it will 
> only change its PMK-R1/PMK-R2 - hence, the exchange will 
> not reach the AAA server. So, unless the HK itself evolves 
> the same way (which means we now rely on a hierarchy of ARs, 
> with SAs between them, etc.) or we make an assumption that 
> PMK-R0 will always change upon inter-subnet handoffs, it 
> becomes a problem for us. So, I am not entirely sure how 
> we can make L3 handover keys applicable for heterogeneous 
> L2 handoffs (whether L2 employs 802.11i/PANA/802.11r/etc) if 
> the L3 HKs are dependent on L2 authentication. 
> 

Creating a shared secret between MN and PAR can be done
assuming some L2 access (or L3 in the SEND-based handover
key derivation draft) authentication method is used, right?
This should be the focus of the draft IMO.

Assuming so, which L3 handover key are you referring to that
would be needed across different L2 access types?
If a MN did .11i, created a shared secret (Sk-L3) for L3 to use,
moved over to a different L2, and then did method auth-Y, why
is the applicability of Sk-L3 on the new L2 important during
a handover?

-Rajeev

> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Fri, 22 Jul 2005 07:58:30 -0700

> is the applicability of Sk-L3 on the new L2 important during

Yes, the MN will have a different IP address on .16 and .11 anyway, so it
should have different handover keys, since the address is acting as the key
name.

        jak