Subject: [eap] Issue: Child key expiry

From: "Narayanan, Vidya" <[email-masked]>
Date: Mon, 1 May 2006 22:59:44 -0700

Submitter name: Vidya Narayanan
    Submitter email address: [email-masked]
    Date first submitted: 5/01/2006
    Reference: 
    Document: Keying Framework
    Comment type: 'T'echnical
    Priority: '2' May fix 
    Section: 3.3
    Rationale/Explanation of issue: 
This section states "When keying material exported by EAP methods
expires,  all keying
   material derived from the exported keying material expires, including
   the TSKs." This seems to indicate that the keys derived from the EMSK
will also be expired when the EMSK expires. It is not yet clear if this
would apply to all kinds of keys derived from the EMSK. There may be
classes of keys derived from the EMSK for which different lifetime
guidelines apply. So, it may be good to clarify that the EMSK usage
documents will specify the guidelines for EMSK-based child keys. 
    
    Requested change:

Change 

"When keying material exported by EAP methods expires,  all keying
   material derived from the exported keying material expires, including
   the TSKs." 

to 

"When keying material exported by EAP methods expires,  all keying
   material derived from the exported keying material expires, including
   the TSKs. Note that different lifetime guidelines may be specified in
future specifications for EMSK-based child keys."
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Nakhjiri Madjid-MNAKHJI1" <[email-masked]>
Date: Tue, 2 May 2006 17:12:54 -0400

I like the last sentence. We need to allow future specs that derive keys
from EMSK to define their own key authorization/ life time policies.
However, given that EMSK is not exported, while MSK is and TSK are
derived from MSK, then the last sentence is probably best inserted
whenever EMSK is being described not here. 

Madjid

-----Original Message-----
From: Narayanan, Vidya [mailto:[email-masked]] 
Sent: Tuesday, May 02, 2006 1:00 AM
To: [email-masked]
Subject: [eap] Issue: Child key expiry 

    Requested change:

Change 

to