Subject: Re: [eap] Re: EAP key binding discussion

From: Jari Arkko <[email-masked]>
Date: Tue, 03 May 2005 16:40:53 +0300

Rafa Marin Lopez wrote:

> After I read this, I think it seems to be similar to PANA when PAA is 
> not colocated in the EP for example in the wireless LAN 
> model(http://www.ietf.org/internet-drafts/draft-ietf-pana-framework-03.txt). 
>
>         In fact PaC/EAP peer can derive one PMK per each EP/AP 
> controlled by PAA.  PAA can derive the same keys that would send to 
> different EPs controlled by this PAA (how to derive PMKs per each 
> EP/AP derived from AAA-key that PAA receives  from AAA is ongoing 
> work). So PAA would be like your LKDC. However PAA is also acting as 
> NAS that is a difference what you propose.
>
> On the other hand , when a EAP peer moves to another EP/AP controlled 
> by another LKDC then we are moving the problem to allow a fast handoff 
> between LKDCs. In the case of PANA , it is being treated in 
> http://www.ietf.org/internet-drafts/draft-bournelle-pana-ctp-02.txt 
> and http://www.ietf.org/internet-drafts/draft-ietf-pana-mobopts-00.txt
>
Moving the key controller node higher in the hierarchy does help a lot.
Both in your example above as well as in various L2 concentrator designs.

Regarding the derivation of "PMKs" per EP, isn't that already specified
in Section 5 of draft-ietf-pana-ipsec-05.txt -- the keys are different 
per EP
address and session ID.

--Jari

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Rafa Marin Lopez <[email-masked]>
Date: Wed, 04 May 2005 14:15:23 +0200

Hi Jari.

Thanks for your answer ... please see below

Jari Arkko wrote:

>> by another LKDC then we are moving the problem to allow a fast 
>> handoff between LKDCs. In the case of PANA , it is being treated in 

Agree

> in Section 5 of draft-ietf-pana-ipsec-05.txt -- the keys are different 

True. Now what I was wondering  if  EAP key management framework  
allows  a  KDC  hierarchy  ... any thought about this?

Thanks.

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------