Subject: Re: [eap] WGLC for eap-keying: EAP server-AAA server

From: Jari Arkko <[email-masked]>
Date: Mon, 07 Nov 2005 15:26:59 +0200

Nakhjiri Madjid-MNAKHJI1 wrote:

>>***MSK and EMSK definitions talk about export. RFC 3748 terminology 
>>does not include "export", so it is not clear what export means.
>>    
>>
>
>The definitions are copied from [RFC3748] without modification.  Note
>that [RFC3748] does include the term "export".  See Section 1.2: 
>
>   Master Session Key (MSK)
>      Keying material that is derived between the EAP peer and server
>      and exported by the EAP method.  The MSK is at least 64 octets in
>      length.  In existing implementations, a AAA server acting as an
>      EAP server transports the MSK to the authenticator.
>
>Madjid>>Given that the definition "assumes" AAA server is the same as
>EAP server, I cannot see what the importing entity is. This is another
>place where separating EAP server and AAA server function would help.
>Given that the current specs give so many 802.11 examples, I don't see
>how an example of what "export" mean would hurt, I am guessing the
>general definition of export is that the EAP method/ server and peer
>will allow another layer (such as AAA layer) to see the keys, so why not
>provide an example.
>  
>
That is indeed the definition of "export". But I think it
is already clear without any text changes. The text
says "exported by the EAP method". This implies delivering
the data out of the EAP method, which is a protocol layer.
So it seems very clear that the data goes to the next layer.
Similarly, "transport" is very clear to me.

--Jari

_______________________________________________
eap mailing list
[email-masked]
http://lists.frascone.com/mailman/listinfo/eap