Subject: RE: [Pana] PANA and lower layer ciphering

From: "Salowey, Joe" <[email-masked]>
Date: Thu, 16 Jun 2005 09:46:42 -0700

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Wednesday, June 15, 2005 10:05 PM
> To: Salowey, Joe
> Cc: Yoshihiro Ohba; [email-masked]
> Subject: Re: [Pana] PANA and lower layer ciphering
> 
> Payload protection keys are indeed derived from the AAA-Key 
> just as in 802.11, so we can't have independence from AAA-Key.
> Independence between the different derived keys is necessary, however.
> 
[Joe] Yes, but you must do the derivation in such as way that the if you
know a key derived from the AAA-Key it is a computationally hard problem
to retrieve the AAA-Key. 

> The interesting bit about PANA is that there are multiple 
> ways of achieving payload protection. Only one has been fully 
> defined, and uses IPsec and IKE. The formula for the keys to 
> use here is
> 
>    IKE Pre-shared Key = HMAC-SHA-1 (AAA-Key, "IKE-preshared key" |
>                            Session ID | Key-ID | EP-address)
>    
> I don't recall if there's anything said about the formula for 
> other usage, e.g., L2 protection. Ideally, all of them should 
> use a different key. Maybe that's your question Joe that this 
> should be specified.
> Just as an example:
> 
>   Pre_Protection key_<Mech> = HMAC-SHA-1 (AAA-Key, "<Mech>" |
>                                                               
>           
>        Session ID | Key-ID)
>   Protection_Key_IKE = HMAC_SHA-1 (Pre_Protection_key_IKE, 
> EP-IP-Address)
>   Protection_Key_11i = HMAC_SHA-1 (Pre_Protection_key_11i, 
> EP-MAC-Address)
> 
> Or something to that effect.

[Joe] Yes, So basically since PANA is using a key derived from the
AAA-Key for its own protection it really should provide the AAA-Key
externally.  If it does that its security becomes dependent upon
protocols that it doesn't define (remember WEP).  PANA should export
some intermediate key.  The Pre_Protection Key described above is one
possible way of doing this.  It seems that it could probably be done
simpler if PANA isn't going to key multiple lower layers at the same
time.  In this case you can have a fixed derivation from the
Pre_Protection Key

Pre_Protection key = HMAC-SHA-1(AAA-Key, "External Protection Key" |
Session ID | Key-ID)

Then the individual external protection specs specify the second half of
the derivation based on the Pre_Protection Key in line with what is
needed for those layers.  This avoids having to maintain a "<mech>"
namespace.  

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Jari Arkko <[email-masked]>
Date: Thu, 16 Jun 2005 21:44:13 +0300

Salowey, Joe wrote:

>(snip)
Yes. Or so it at least seems today. (I must confess I'm
a bit worried that the assumption about single lower layer
at a time may not hold in all future scenarios. What if you
do a fast handoff from a WEP link to a IPsec link?)

--Jari

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 17 Jun 2005 10:48:06 -0400

> do a fast handoff from a WEP link to a IPsec link?)

In the case where fast handoff is required among different lower
layers, I'd rather prefer having IPsec over those lower layers, with
putting IPsec EP multiple hops away from PaC...

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 21 Jun 2005 09:22:45 -0400

Hi Joe and Jari,

> needed for those layers.  This avoids having to maintain a "<mech>"

I think that we do not need to seperate the first and second halves,
since each EP is uniquely identified by the address-family and address
pair and the pair is contained in Device-Id AVP.  We can simply
involve not only the address but also address-family in the
computation of PaC-EP master keys, something like:

PaC-EP-Master-Key = HMAC-SHA-1 (AAA-Key, "PaC-EP master key" |
                                Session ID | Key-ID | EP-Device-Id)

(EP-Device-Id: the value field of Device-Id AVP)

In the case of pana-ipsec, IKE Pre-shared Key is a PaC-EP-Master-Key
where EP-Device-Id is a Device-Id of IPsec EP.

What do you think?

Yoshihiro Ohba