Subject: Re: [eap] issue 379: Definitions

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 05 Oct 2006 23:42:11 -0700

A quesiton has arisen about the definition of some other terms used in the 
document.   There include "Session-Id" and "Key Scope".   Here is a shot at 
definitions of these terms:

Session-Id
The EAP Session-Id uniquely identifies an EAP authentication exchange 
between an EAP peer
(as identified by the Peer-Id) and server (as identified by the
Server-Id).  For more information, see Section 1.4.

Key Scope
The parties to whom a key is available.

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/eap

Arhives: http://lists.frascone.com/pipermail/eap

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 6 Oct 2006 11:23:15 +0300

> Server-Id).  For more information, see Section 1.4.

Is the "session-id" good until the EAP-Success/Failure exchange, or until
the expiration of the MSK/EMSK? I think it is the latter.

Alper

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 06 Oct 2006 08:14:55 -0700

I think there is a disctinction between the Session-Id and the lifetime of 
the keys that it is used to refer to.

The Session-Id should be unique both globally and temporally, so in theory 
it should have an infinite lifetime.  Of course, the keys that the 
Session-Id can be used to name do have a lifetime.

Is the problem with the definition that it refers to an "EAP authentication 
exchange", seeming to imply that once the exchange has completed it is no 
longer useful?

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 6 Oct 2006 23:59:00 +0300

> exchange", seeming to imply that once the exchange has completed it is no

Yes. 

Does it make sense to use "state" instead of "exchange"?

Alper

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 06 Oct 2006 14:44:42 -0700

>Does it make sense to use "state" instead of "exchange"?

A given peer and server could execute a number of EAP authentication 
exchanges each of which would have its own Session-Id.  So the Session-Id 
uniqely identifies the product of a successful EAP autentication (e.g. the 
keying material exported from the method).   Of course, if the 
authentication is unsuccessful, the keying material does not exist, so even 
though there still might be a Session-Id, there is no keying material to 
name.