Subject: RE: [Pana] PANA and lower layer ciphering

From: "Salowey, Joe" <[email-masked]>
Date: Thu, 16 Jun 2005 17:48:06 -0700

> > 
> > [Joe] Why must they be bound to lower layer parameters?  
> This should 
> > be done in the lower layer instead of creating dependencies 
> in PANA on 
> > the lower layer.  PANA exports a key and the lower layer is free to 
> > use it how it wishes, including deriving additional keys that have 
> > specific binding to lower layer parameters.
> 
> At least the PaC-EP master key needs to be associated with 
> the identity of the consumers (i.e., the PaC and EP) so that 
> the PaC and EP can make sure that which master key is used 
> for which peer.
> 

[Joe] I think this is a function of a lower layer.  If you are going to
include identities in the key derivation from PANA it should be the
identities that are authenticated namely the PaC and PAA (or realm the
PAA serves).  It is the job of the lower layer to scope how the keys
should be used.  Different lower layers may specify the scope of the
lower layer keys, I'm not sure that the PANA layer wants to anticipate
this since it may differ.  

I think we are not too far apart in our thinking.  I think we should do
a derivation that is mostly independent of lower layer in the PANA layer
to keep from having to have the AAA Key leave the PANA layer and to keep
PANA relatively independent of the lower layer.  When we define
mechanism specific uses for the specific lower layers (such as IPsec)
that derive keys according to the requirements of the lower layer, which
will use lower layer parameters.   

> > 
> > > > 
> > > > If negotiation is necessary then why is the
> > > Protection-Capability AVP
> > > > only indicated by the PAA, shouldn't the PaC be able to
> > > indicate this
> > > > as well?
> > > 
> > > The current PANA design on this is that ciphering layer is not 
> > > negotiable.  This is because if we allow multiple choices on 
> > > ciphering layers, then it might end up with a situation 
> where some 
> > > PaC uses L3 ciphering while others use L2 ciphering in the same 
> > > access network, which might open up a security hole.
> > > 
> > 
> > [Joe] Interesting, can you elaborate on this problem?  
> > 
> 
> Assume that there are two EPs on a single IP link where one 
> EP is an WLAN AP using IEEE 802.11i and another EP is an 
> access router using IPsec.  Note that there is at least one 
> open-access AP on the link to make this work.  Then an 
> unauthorized attacker may access the link via open-access AP 
> to launch L3 or higher layer attacks on the legitimate PaCs 
> that are using 802.11i.
> 

[Joe] Ok, this seems deployment sensitive. It would be less of a problem
if the EP for both layers was the same. 

> Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 17 Jun 2005 00:12:06 -0400

On Thu, Jun 16, 2005 at 05:48:06PM -0700, Salowey, Joe wrote:
> [Joe] I think this is a function of a lower layer.  

I think we should separate two things:

- The PaC and PAA derive a separate PaC-EP master key per EP.

- The PaC and EP verify the possession of the PaC-EP master key.

Although the latter definitely needs to be done at the lower layer
between the PaC and EP, the former needs to be done between the PaC
and PAA.  Also, in the current PANA design, it is not possible to
derive a separate PaC-EP master key per EP without including identity
of EP in the key derivation.  (Note that if the PANA design were to
support separate random number exchanges per EP, the random number
instead of the identity of the EP could have been used for generating
a separate PaC-EP master key, by associating each random number to a
distinct EP in PANA.  But I am not going to propose it because it is
not simpler than the current design.)

> If you are going to
> PAA serves).  

Yes, in the case of pana-ipsec, PANA Session ID is also involved in
the PaC-EP master key derivation for that purpose.

> It is the job of the lower layer to scope how the keys

I agree, except that the scope of PaC-EP master key itself needs to be
determined by the entities that derive that key.

> will use lower layer parameters.   

I agree.  I think having an additinal level of key hierarchy between
AAA-Key and PaC-EP master key (e.g., Pre_Protection key_<Mech>
proposed by Jari) might be good to keep such independency between PANA
and lower layer.

Yoshihiro Ohba