Subject: [HOKEY] Agenda for Interim Meeting

From: "Charles Clancy" <[email-masked]>
Date: Wed, 3 Jan 2007 13:58:01 -0500 (EST)

All,

As announced earlier on the list, we'll be having an interim meeting in
San Jose on January 23 (in conjunction with the CAPWAP interim on Jan
24/25).  If you plan to attend and have not yet registered, please do so
no later than January 12 on the interim website:

        http://www.ltsnet.net/ietf/67.5/

The preliminary agenda for the imterim meeting is as follows:

0900-1100: problem statement and EMSK keying hierarchy

     http://tools.ietf.org/html/draft-clancy-hokey-reauth-ps
     http://tools.ietf.org/html/draft-salowey-eap-emsk-deriv

     Brief overview (chairs)
     Discussion (resolve any issues with the drafts)

1100-1230: lunch

1230-1300: EAP ER (Vidya/Lakshminath)

     http://tools.ietf.org/html/draft-vidya-eap-er

1300-1700: Reauthentication discussion and resolution

     Major discussion points requiring resolution:
      - Keying (hierarchy vs keywrap, MSK vs EMSK)
      - Protocol transport (EAP-native or method-based)
      - Backwards compatability (L2 signalling, timeouts, etc)
      - Affect on lower layers (state machine, etc)
      - Peer vs server initiated

-- 
t. charles clancy, ph.d.  <>  [email-masked]  <>  www.cs.umd.edu/~clancy

_______________________________________________
HOKEY mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hokey

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 04 Jan 2007 07:33:35 -0800

Hi Charles,

Happy New Year!

Many thanks for distributing the agenda well in advance.  I 
appreciate that very much.  I think I understand most of the topics 
reasonably well, except the part on the scheduled discussion on 
"hierarchy vs keywrap."

Does keywrap mean that delivering a random key wrapped with a shared 
secret between the server and the peer is an alternative to deriving 
keys as in case of a hierarchy?  Vidya and I spent a few minutes 
going down that path and thought there might be some serious issues 
with a notion like that.  Before getting into the details, could you 
please elaborate on what is "keywrap."

thanks,
Lakshminath

---

From: Charles Clancy <[email-masked]>
Date: Fri, 05 Jan 2007 08:41:26 -0500

Lakshminath Dondeti wrote:
 > keys as in case of a hierarchy?

Yes.

-- 
t. charles clancy, ph.d.  |  [email-masked]  |  www.cs.umd.edu/~clancy

---

From: Lakshminath Dondeti <[email-masked]>
Date: Fri, 05 Jan 2007 10:03:35 -0800

A rough analysis that got me worried about the keywrap technique:

Suppose the Server sends Blob1 = Enc(Wrapping-Key, Access-Key) and 
Blob2 = Access-Key to the Authenticator.  Blob1 is for the Peer and 
Blob2 is for the Authenticator.  Both blobs are encrypted using IPsec 
between the Server and the Authenticator.  Wouldn't the Authenticator 
have an opportunity to cryptanalyze for the Wrapping-Key?

regards,
Lakshminath

---

From: Madjid Nakhjiri <[email-masked]>
Date: Fri, 05 Jan 2007 12:24:38 -0800

Hi Charles, 

Thanks for the agenda.
As far as I understand we are talking about both keying hierarchy and
re-authentication problems and there are several solution proposals? However
overlapping they are or are not, how come only one draft shows on the
agenda?
Also I am confusing about keying versus keywrap thing. This is not reflected
in the PS draft.

R,

Madjid

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Wednesday, January 03, 2007 10:58 AM
To: [email-masked]
Subject: [HOKEY] Agenda for Interim Meeting

All,

     Brief overview (chairs)

1100-1230: lunch

---

From: Charles Clancy <[email-masked]>
Date: Fri, 05 Jan 2007 16:01:49 -0500

Madjid,

Are there other protocol drafts?  If so, then they can be added to the 
agenda.

I think the meaning of the keying vs keywrap was clarified.  I don't see 
why it would need to be addressed in the PS draft.  It's part of the 
solution, not the problem.  It's the same reason MSK/EMSK discussion is 
not in the PS draft.

---

From: Madjid Nakhjiri <[email-masked]>
Date: Fri, 05 Jan 2007 13:58:11 -0800

I agree with this. I think we want to go the path of key hierarchy.
To come to the rescue (as my 4 year old says:))  the only place key wrap
comes into picture in my mind is transport of keys of the hierarchy from one
location to other, say AAA server to key holders/authenticators.

Madjid

-----Original Message-----
From: Lakshminath Dondeti [mailto:[email-masked]] 
Sent: Thursday, January 04, 2007 7:34 AM
To: Charles Clancy
Cc: [email-masked]
Subject: Key Hierarchy vs. KeyWrap (Re: [HOKEY] Agenda for Interim Meeting)

Hi Charles,

Happy New Year!

thanks,
Lakshminath

---

From: Madjid Nakhjiri <[email-masked]>
Date: Mon, 08 Jan 2007 14:32:30 -0800

Hi Charles,

Yes, the following:

http://tools.ietf.org/wg/hokey/draft-nakhjiri-hokey-hierarchy-02.txt

I am still fuzzy, since I thought I saw a comment that key wrap would be an
alternative to hierarchy? If that is the discussion, then I missed the
clarification. 
I am not arguing it should be in the PS, since I assumed we are going with
the hierarchy.
Well, MSK/EMSK decision is a big part of the problem, whether or not it is
in the current PS draft. 

Madjid

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Friday, January 05, 2007 1:02 PM
To: Madjid Nakhjiri
Cc: [email-masked]
Subject: Re: [HOKEY] Agenda for Interim Meeting

Madjid,

---

From: Madjid Nakhjiri <[email-masked]>
Date: Mon, 08 Jan 2007 16:31:49 -0800

Ok, this is the response that made me confused. Are we saying the key
wrapping is a substitute for key hierarchy from EAP MSK/EMSK? If yes, then I
am lost.

Madjid

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Friday, January 05, 2007 5:41 AM
To: Lakshminath Dondeti
Cc: [email-masked]
Subject: Re: Key Hierarchy vs. KeyWrap (Re: [HOKEY] Agenda for Interim
Meeting)

Yes.

---

From: Charles Clancy <[email-masked]>
Date: Tue, 09 Jan 2007 07:15:55 -0500

An example of "KeyWrap" would be deriving a USRK from the EMSK and then 
using that USRK to transport a re-auth key from the server to the peer, 
rather than using the USRK directly.

---

From: Madjid Nakhjiri <[email-masked]>
Date: Tue, 09 Jan 2007 10:53:37 -0800

First of all the USRK seems to be misunderstood, it is supposed to be the
mother of all other keys for handover and re-auth. Where does the re-auth
key itself come from? What about the per-authenticator keys? 

I don't think USRK itself should be used to wrap a single key, while we have
a lot of keys to derive. We can debate whether we can use a key derived from
USRK for key wrapping, but I don't think we can do away without a hierarchy.

Furthermore, I personally have issues in key management methods, based on
key transport rather than key agreement. Many security principles in Russ's
draft can easily be violated.

Well I guess we can discuss all this in the meeting.

Madjid

-----Original Message-----
From: Charles Clancy [mailto:[email-masked]] 
Sent: Tuesday, January 09, 2007 4:16 AM
To: Madjid Nakhjiri
Cc: 'Lakshminath Dondeti'; [email-masked]
Subject: Re: Key Hierarchy vs. KeyWrap (Re: [HOKEY] Agenda for Interim
Meeting)

---

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 09 Jan 2007 15:46:45 -0800

Madjid,

Could you explain why key transport has more issues than key 
agreement?  11i has both key transport and key derivation at the 
4-way exchange level.  Why would doing it at the EAP level be a problem?

Lakshminath

---

From: Madjid Nakhjiri <[email-masked]>
Date: Tue, 09 Jan 2007 16:26:42 -0800

You said it yourself, there is no "agreement" in transport :)
What you mean by "doing it at EAP level"? I have trouble with not knowing
what is being suggested here?

Madjid

-----Original Message-----
From: Lakshminath Dondeti [mailto:[email-masked]] 
Sent: Tuesday, January 09, 2007 3:47 PM
To: Madjid Nakhjiri; 'Charles Clancy'
Cc: [email-masked]
Subject: RE: Key Hierarchy vs. KeyWrap (Re: [HOKEY] Agenda for Interim
Meeting)

Madjid,

Lakshminath

> > wrapping is a substitute for key hierarchy from EAP MSK/EMSK? If yes,
then
>I