Subject: [eap] Issue 380: Sync with AAA Key Management Document

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 19 Oct 2006 12:47:14 -0700

Issue 380: Sync with AAA Key Management Document
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date Submitted: October 19, 2006
Reference: 
http://www.ietf.org/internet-drafts/draft-housley-aaa-key-mgmt-04.txt
Document: KEYING-14
Comment type: Technical
Priority: S
Section: 1.2
Rationale/Explanation of issue:

The AAA Key Management document includes some definitions
not in the EAP Key Management framework document. Also, there are some
definitions that are not identical. Also, the AAA Key Management
document references NIST SP800-57 with respect to key strength as well as
BCP 86 [RFC3766].

To get the two documents in sync, I would propose the following:
Update the terminology section with the following entries:

"Key Wrap
The encryption of one symmetric cryptographic key in another.
The algorithm used for the encryption is called a key wrap
algorithm or a key encryption algorithm. The key used in the
encryption process is called a key-encryption key (KEK).

Secure Association Protocol
An exchange that occurs between the EAP peer and authenticator
in order to manage security associations derived from EAP
exchanges. The protocol establishes unicast and multicast security
associations, which include symmetric keys and a context for
the use of the keys. An example of a Secure Association
Protocol is the 4-way handshake defined within [802.11i].

Transient Session Keys (TSKs)
Keys used to protect data exchanged after EAP
authentication has successfully completed, using the
ciphersuite negotiated between the EAP peer and authenticator.

4-Way Handshake
A pairwise Authentication and Key Management Protocol (AKMP)
defined in [802.11i], which confirms mutual possession of a
Pairwise Master Key by two parties and distributes a Group Key."

Change the 3rd paragraph in Section 3.7 from:

" As noted in [RFC3766] Section 5, this results in the following
required RSA or DH module and DSA subgroup size in bits, for a given
level of attack resistance in bits:"

To:

"BCP 86 [RFC3766] offers advice on appropriate key sizes. The National
Institute for Standards and Technology (NIST) also offers
advice on appropriate key sizes in [SP800-57].

[RFC3766] Section 5 advises use of the following
required RSA or DH module and DSA subgroup size in bits, for a given
level of attack resistance in bits:"

Add a reference to [SP800-57]:

[SP800-57]  National Institute of Standards and Technology,
"Recommendation for Key Management", Special Publication 800-57, May 2006.

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: Jari Arkko <[email-masked]>
Date: Fri, 20 Oct 2006 12:45:53 +0300

Looks good to me.

--Jari