Subject: SeNAA issue on MAC.

From: Pagliusi PS <[email-masked]>
Date: Fri, 8 Nov 2002 19:55:10 -0000

Dear authors of the document below and other members of PANA WG:

Secure Network Access Authentication (SeNAA)
<draft-forsberg-pana-secure-network-access-auth-01.txt>
Date: 2002-10-31.

SeNAA can be a very interesting candidate to PANA protocol. It employs
standard protocols for (lightweight) transport (UDP), transport security
(TLS) and user authentication (EAP), beyond to use Diameter message header
and AVP format, which contribute to facilitate the extension of the
signaling between PaC and PAA to the (AAA) back-end authentication server.

Nevertheless I have a small issue on the Internet-Draft SeNAA description.
The document mentions that re-authentication with TLS (phase 1) involves
multiple exchanges of CSAR and CSAA (item 3.4). And also that these two kind
of messages contains Msg-Checksum AVPs (Figure 2b).

Consistent with items 3.3 and 5.2, a MAC is calculated over the Diameter
message and put into the Msg-Checksum AVP. However, in accordance with
[Menezes], a MAC (message authentication code) is a 'keyed hash function'.
Therefore, since probably there is no valid SA established yet (Phase 1 is
not finished in a re-authentication), I wonder: where is the key coming
from?

Another minor observation is that the issue and expiration dates of the
document should be changed from 16 September to 31 October 2002 and from
March to April 2003, respectively, in order to avoid further confusion with
the old version.

Yours faithfully,

Paulo.

P.S. See you next week at the 55th IETF Meeting in Atlanta!
______________________________________________________________________
Paulo Pagliusi.
[email-masked]
Brazilian Navy Researcher - Information Security Group
Royal Holloway, University of London.
______________________________________________________________________
[Menezes] Menezes, A., van Oorschot, P., Vanstone, S.: Handbook of Applied
Cryptography. CRC Press, Boca Raton (1997), pp. 352.

---

From: <[email-masked]>
Date: Mon, 11 Nov 2002 16:25:23 +0200

Paulo,

Thank you for your comments. In TLS handshake the client and server have the same keying material and negotiated ciphers. This information is available during the session resumption also. The MAC key can be based on this material. The Msg-Checksum AVP could even be outside the TLS-Payload AVP in this case.

Frankly speaking, I'm not sure if we need a MAC in the Msg-Checksum AVP in every situation (or if we need checksum in the session resumption either). It could be a  checksum without a key for authentication (i.e. like CRC, MD5 etc.), when TLS provides the authentication and integrity protection.

B.r.,
- Dan

> -----Original Message-----
> From: ext Pagliusi PS [mailto:[email-masked]]
> Sent: 08 November, 2002 21:55
> To: 'Pana (E-mail) '
> Subject: SeNAA issue on MAC.
> 
>