Subject: Re: [eap] RE: EAP key management support for handover??

From: Jari Arkko <[email-masked]>
Date: Mon, 02 May 2005 11:09:19 +0300

Hi Madjid

>Here are my issues:
>1) After reading the draft a few times, I am still not clear how EMSK is derived? And what the distinction between MSK and EMSK is?
>  
>
They are just different pieces of key material expected to come out
of all EAP methods. MSK and EMSK are independent in the sense that
if you have MSK, you can't calculate EMSK and vice versa.

The actual derivation of both MSK and EMSK is method
depend. For instance, in EAP TLS MSK is the first 64 bytes
and the EMSK is the last 64 bytes of

  TLS-PRF-128(TMS, "client EAP encryption",
                      client.random || server.random)

>2) on generation of AAABS-Key-A, I am wondering why there is first AMSK(0,63) and then AAA-key? Aren't they the same (according to the first expression). Is this just the notation, or the AMSK is actually used twice?
>  
>
AMSK(0,63) is used multiple times, but only to branch of new keys tied 
to the
specific AP identities.

>3) Ok, so if the AAABS-key is derived based on the AMSK only and the AMSK is never transported from the AAA server, and only AAA-key is transported to the authenticator, that partly addresses my concern. But what does transferring the AAA-key to the authenticator achieve anyway?
>  
>
Transferring AAA-Key to the authenticator is necessary because that's
what current systems do -- AAA-Key is used to handle the keying for
the first access point.

>For every new authenticator the AAABS-key must still be derived by the AAA server?
>  
>
In this model, yes.

>Deriving keys from the AMSK formula not only enables cryptographic
>separation, but it addresses the domino effect as well since the EMSK
>never leaves the peer or server on which it is derived.
>
>Madjid>>agreed, however, I still now how EMSK is derived?
>  
>
See above.

--Jari
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Mon, 2 May 2005 07:47:45 -0500

Hi Jari,

Thank you for pointing the formula to me. Actually I went through the EAP draft a few hours after my email and did find the formula on EMSK. I guess now Bernard's point with the key derivation makes a bit more sense:

AAA-Key = MSK(0,63)

      AMSK = KDF(EMSK, "EAP AAA-Key derivation for multiple attachments",
                  length)

      AAABS-Key-A = prf(AMSK(0,63),"EAP AAA-Key derivation for
                  multiple attachments", AAA-Key, BS-A-Id,
                  Peer-Id,length)

AAA-key is derived from MSK, while AMSK is derived from EMSK and AAABS-key is derived from both. Part of MSK is sent to the authenticator in form of AAA-key. EMSK stays as a whole in the peer and server, which I guess means AMSK is derived only at the peer and the server. I see your point about using AMSK(0,63) multiple times for multiple AAABS-keys, however
I am trying to understand what the reasoning for the fact that both AMSK and AAA key are used for AAABS-key derivation? 
Say I want to derive the keys for one BS, this would mean I would calculate AAABS-key for the BS (authenticator) at the server and push AAABS-key to that BS. What would the purpose of pushing the AAA-key to that authenticator be? You say AAA-key is sent for "keying at the first access point"?
I would appreciate some clarification on this.

Thanks,

Madjid

-----Original Message-----
From: Jari Arkko [mailto:[email-masked]] 
Sent: Monday, May 02, 2005 3:09 AM
To: Nakhjiri Madjid-MNAKHJI1
Cc: 'Bernard Aboba'; [email-masked]
Subject: Re: [eap] RE: EAP key management support for handover??

Hi Madjid

In this model, yes.

See above.

--Jari