Subject: Re: [HOKEY] EMSK Hierarchy Changes

From: "M. Vanderveen" <[email-masked]>
Date: Thu, 25 Jan 2007 09:38:02 -0800 (PST)

The proposed hierarchy is better suited for the architecture we are targeting. 

One issue that will come up once we get down to writing equations on EMSK derivation is the server specific vs. domain-specific. Presumably each EMSK-ServerX has the NAI of the server folded in it or at least in its name. Perhaps this can be a FQDN. In any case, if the identity of the domain or the server is to be input into a hash function, then the Peer has to be informed of that. Needless to say, upon attachment the Peer may know the domain name but probably not the NAI of the AAA-L / local EAP server.  Perhaps the solution to this is as it was with the original USRKs, whereby the "optional data" transport to the Peer was out of scope...

Michaela

----- Original Message ----
From: Charles Clancy <[email-masked]>
To: [email-masked]
Sent: Wednesday, January 24, 2007 4:31:29 PM
Subject: [HOKEY] EMSK Hierarchy Changes

At the interim meeting, there was consensus to make the following
changes to the EMSK keying hierarchy:

Currently, it looks like:

EMSK --+-- USRK1
        +-- USRK2
        \-- USRK3

The proposed change is to make it look like:

EMSK --+-- EMSK-Server1 --+-- Server1-USRK1
        |                  \-- Server1-USRK2
        +-- EMSK-Server2 --+-- Server2-USRK1
        |                  \-- Server2-USRK1
        \-- EMSK-Home -----+-- Home-USRK1
                           \-- Home-USRK2

The advantage here is that the home EAP server can distribute
server-specific EMSKs to servers throughout the network.  These servers
can then derive USRKs without having to communicate with the home EAP
server.  The home EAP server can distribute a key to a local keying
server, which can then generate USRKs for use within its own network.

-- 
t. charles clancy, ph.d.  <>  [email-masked]  <>  www.cs.umd.edu/~clancy

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

____________________________________________________________________________________
Need a quick answer? Get one in minutes from people who know.
Ask your question on www.Answers.yahoo.com

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Madjid Nakhjiri <[email-masked]>
Date: Wed, 31 Jan 2007 11:25:28 -0800

I agree with Michaela here. I noticed that as well with my problem solving
hat (light weight, moisture wicking:-)) on.

How do we signal the intermediary server ID to the peer, when none of the
intermediaries are involved in EAP? Not impossible to solve however, but may
add to RTs, if the exchange has to be done through exchanges following the
initial EAP. For instance, following the EAP success, the AAA client in
serverX domain can send that to the peer, however, what I am wondering in
that case is when we use new EAP codes, the new EAP messages have to go
between peer and now a new EAP server?

Madjid 

  _____  

From: M. Vanderveen [mailto:[email-masked]] 
Sent: Thursday, January 25, 2007 9:38 AM
To: Charles Clancy; [email-masked]
Subject: Re: [HOKEY] EMSK Hierarchy Changes

The proposed hierarchy is better suited for the architecture we are
targeting. 

One issue that will come up once we get down to writing equations on EMSK
derivation is the server specific vs. domain-specific. Presumably each
EMSK-ServerX has the NAI of the server folded in it or at least in its name.
Perhaps this can be a FQDN. In any case, if the identity of the domain or
the server is to be input into a hash function, then the Peer has to be
informed of that. Needless to say, upon attachment the Peer may know the
domain name but probably not the NAI of the AAA-L / local EAP server.
Perhaps the solution to this is as it was with the original USRKs, whereby
the "optional data" transport to the Peer was out of scope...

Michaela

----- Original Message ----
From: Charles Clancy <[email-masked]>
To: [email-masked]
Sent: Wednesday, January 24, 2007 4:31:29 PM
Subject: [HOKEY] EMSK Hierarchy Changes

EMSK --+-- USRK1
        +-- USRK2
        \-- USRK3

 

  _____  

Everyone is raving about the
<http://us.rd.yahoo.com/evt=42297/*http:/advision.webevents.yahoo.com/mailbe
ta>  all-new Yahoo! Mail beta.