Subject: [eap] Re: AMSKs for MIPv6

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 03 Nov 2005 17:45:40 -0800

>MN <------> HA <-------> AAA

>So we'll need exchange between MN and HA and between HA and AAA.

Is an EAP exchange being run between the MN and AAA server, with the HA 
serving as the "EAP authenticator"?  If so, the end result of this exchange 
is that the MN, HA and AAA server share a key.

>The EAP peer and server derive MSK and EMSK. The
>AAA server requests to the EAP server an 'AMSK for Mobile IPv6'.
>
>A mobility management entity (not the EAP lower layer) on the mobile
>node requests locally the 'AMSK for Mobile IPv6' to the EAP layer.

Assuming that the HA is acting as an "EAP authenticator" here, the end 
result of this is that the MN and the EAP server/AAA server now have 
mutually authenticated to each other and have derived an AMSK that they know 
is fresh, and which is known only to them.   The HA and AAA server now 
mutually authenticate and derive a cryptographically secure channel.  The 
AMSK is now transported to the HA, which can use it in a mutual proof of 
possession exchange with the MN.

>Then, if we want that the mobile node shares a key with the HA, this
>implies that the HA requests a key to the AAA server.

Before the HA can request a key from the AAA server, it needs to prove that 
it is authorized to receive that key.   Typically this requires that it 
mutually authenticate to the AAA server *and* include some "proof of 
liveness" from the EAP peer to show that the peer is actually interested in 
communicating with it.

So a better way to think about this is that the HA is not really requesting 
a key -- it is the EAP peer that is requesting that the AAA Server send a 
key to that specific HA.   If the EAP peer and AAA server share a trust 
relationship and are mutuall authenticated, and if the HA and AAA server are 
mutually authenticated, and if the key that is being requested is 
unambiguously specified (e.g. it is "named"), then the AAA server will 
authorize the request and transport the key to the HA.

>I stay vague here. But one can imagine that the 'AMSK for Mobile IPv6'
>is used by the MN to authenticate himself to the AAA.

"Key Request" proposals typically require mutual authentication between the 
EAP peer and AAA server.  For example, if the MN/peer had previously 
established a cached AMSK with the AAA server, it can subsequently prove 
possession of that AMSK, and ask that a key derived from that AMSK be sent 
to an HA that it specifies.   This request needs to be "routed" through the 
HA itself, which mutually authenticates to the AAA server.  This guarantees 
that the "Key Request" is authenticated, bound to the entities involved in 
the exchange, and can generate fresh keys (this part probably requires 
nonces to be exchanged by the parties).

>This pre-shared key will be derived at MN and AAA from the "AMSK for
>Mobile IPv6" and then transported from the AAA to the HA.

If the key is dynamically derived it is not a pre-shared key.

>SO the 'AMSK for Mobile IPv6' is cached on the AAA server and MN but
>not transported. The key derived for MN-HA is deleted on the AAA and
>transported to the HA.

Right.

>Does such a mechanism seem correct respective to EAP keying framework ?

It seems compatible with the "Key Request" extension that has been 
discussed.

_______________________________________________
eap mailing list
[email-masked]
http://lists.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Sun, 06 Nov 2005 01:38:51 +0200

Bernard Aboba wrote:

> Is an EAP exchange being run between the MN and AAA server, with the 
> HA serving as the "EAP authenticator"?  

There are multiple scenarios. If the scenario is according to your
assumption above, then there may be no need at all for new protocols
or keys. Specifically, MNs can, already today use EAP
authentication to the home agent via draft-ietf-mip6-ikev2-ipsec,
IKEv2, and IKEv2 EAP mode. This implies that AAA server delivers
an MSK to the HA which is then subsequently used by IKEv2
authentication process; DH keys are used in IKEv2 to get keys
for the actual IPsec SA which protects the BUs.

So that works today, I think.

What Julien, Gerardo et al are addressing is probably a
different scenario, however. I'm not quite sure what
the complete list of scenarios is. But one scenario that
I can think of is where there's a desire to avoid a second
AAA transaction from the HA by using an AMSK from an
EAP authentication that already happened for other
purposes. I remain personally unconvinced that such
an optimization is needed, because there's a lot of
protocol design, implementation effort, and assumptions
to eliminate a few roundtrips from something that
only needs to happen once (not on every movement).

A third scenario is when not IPsec but
mip6-auth-option is used when there's no
credential that fits mip6-auth-option usage
directly.  (If such credential were available, then we
would not need anything beyond mip6-auth-option.
Note also that such credential may exist through
roaming relationship, not necessarily needed to have
it in HA or local AAA.) The only practical case that
I can think of where this becomes a problem is where
MN has an EAP credential (e.g. SIM, TLS) for the
home network but that credential is not fit for
usage in mip6-auth-option because it needs to be
a plain shared secret.

Anyway, in that scenario EAP-based AMSKs could
potentially be used as the shared secrets for
mip6-auth-option. This seems largely inline with
what EAP keying framework allows to do, but
of course the devil is in the details, and there'd
have to be a document that describes the security
analysis of the system. I tend to agree with you Bernard
that the HA needs to be involved in some way.

Julien, Gerardo, Avi -- what are the scenarios where
you'd like to use AMSK?

--Jari

---

From: Julien Bournelle <[email-masked]>
Date: Sun, 6 Nov 2005 18:22:46 +0100

Hi jari,

> Julien, Gerardo, Avi -- what are the scenarios where

 the scenario that I had in mind is the one described by gerardo. We
 have an authentication for network access using EAP. We derive an AMSK
 for mip6. Then the mobile obtains an home agent and runs IKEv2. But
 we'd like to use psk for authentication instead of EAP in the IKEv2
 exchange. In this case, while recieving the third message of IKEv2 with
 AUTH payload (the MN uses the AMSK-mip6 or key derived from AMSK-mip6
 as psk), the HA requests the key to the AAA.

 Other services such as FMIPv6 may benefit from such a mechanism based
 on AMSK.

 Julien

-- 
julien.bournelle at int-evry.fr
_______________________________________________
eap mailing list
[email-masked]
http://lists.frascone.com/mailman/listinfo/eap

---

From: Jari Arkko <[email-masked]>
Date: Mon, 07 Nov 2005 01:45:01 +0200

> as psk), the HA requests the key to the AAA.
But is the reason to use PSK instead of EAP solely an
optimization issue, or are there roaming limitations
or somethat actually prevents the use of EAP?

As I mentioned in my original post, I'm not at all
convinced that we need to spend a lot of effort
optimizing the bootstrap procedure, if it already
works with existing protocols.

> Other services such as FMIPv6 may benefit from such a mechanism based
Maybe. Can you expand on why they would benefit?

--Jari