Subject: [Pana] PANA and lower layer ciphering

From: "Salowey, Joe" <[email-masked]>
Date: Wed, 15 Jun 2005 12:01:45 -0700

The PANA (draft-ietf-pana-pana-08) indicates that EAP keying material
may be used to create a PANA security association and lower layer
security associations.  The draft describes how to derive PANA keys from
the EAP AAA-Key.  I do not think the draft provides enough detail on the
use of keys for link-layer or network layer ciphering.  The draft needs
to ensure that the use of keys in the lower layer does not compromise
the security of the PANA communications.  Currently the draft contains
only brief text on this point.  The draft should specify how to derive a
key that can be used in the lower layer that is cryptographically
independent of the AAA-Key and the PANA keys.  This would help eliminate
the possibility that a AAA-key is used directly by a lower layer
protocol or that a lower-layer key is derived that is not
cryptographically independent from the PANA keys.  This should be
specified in the PANA protocol spec rather than trying to coordinate it
in multiple lower layer specs.  

I also have some questions on the Protection-Capability AVP.  

Shouldn't this capability be negotiated by the lower layers, why is it
necessary to do this in PANA?  

If negotiation is necessary then why is the Protection-Capability AVP
only indicated by the PAA, shouldn't the PaC be able to indicate this as
well?

Joe

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 15 Jun 2005 18:12:42 -0400

Hi Joe,

On Wed, Jun 15, 2005 at 12:01:45PM -0700, Salowey, Joe wrote:
> only brief text on this point.  

Yes, we have some text in section 10.5:

"
   When link-layer or network-layer ciphering [I-D.ietf-pana-ipsec] is
   enabled as a result of successful PANA authentication, a separate
   PaC-EP master key is generated based on the AAA-Key, session
   identifier, key identifier, and EP device identifier.
"

> The draft should specify how to derive a
> independent of the AAA-Key and the PANA keys.  

Although PaC-EP master keys are cryptographically independent of each
other and of PANA keys, PaC-EP master keys are cryptographically
dependent on the AAA-Key because they are derived from AAA-Key.

> This would help eliminate

I believe that key derivation algorithms for PaC-EP master keys cannot
be independent of lower layers, because lower layer parameters such as
authenticator identifier would need to be bound to the master keys.
Thus, I think what we can describe in the PANA protocol spec is
something like: "The PaC-EP master keys MUST be drived from the
AAA-Key, bound to appropriate lower layer parameters and
cryptographycally independent of each other".

> necessary to do this in PANA?  

Protection-Capability AVP is used for indicating whether L2 or L3
ciphering is used.  Once the lower layer that does ciphering is
determined, the rest of the negotiation is to be done at that lower
layer.

> only indicated by the PAA, shouldn't the PaC be able to indicate this as

The current PANA design on this is that ciphering layer is not
negotiable.  This is because if we allow multiple choices on ciphering
layers, then it might end up with a situation where some PaC uses L3
ciphering while others use L2 ciphering in the same access network,
which might open up a security hole.

Yoshihiro Ohba