Subject: RE: [Mip6] Security Section Comments ondraft-ietf-mip6-bootstrap-ps-01.txt

From: [email-masked]
Date: Fri, 25 Feb 2005 08:02:02 +0200

I agree with James on this.  Yoshi - do you think the current text prevents
both the network access & mobility service from sharing the same EAP master key?

John

> -----Original Message-----
> From: ext James Kempf [mailto:[email-masked]]
> Sent: 24 February, 2005 20:42
> To: Yoshihiro Ohba; Loughney John (Nokia-NRC/Helsinki)
> Cc: [email-masked]
> Subject: Re: [Mip6] Security Section Comments 
> ondraft-ietf-mip6-bootstrap-ps-01.txt
> 
> 
> Yoshi,
> 
> This works if EAP is used, but it might not be. From the 
> perspective of the
> problem statement, I think it is sufficient to state that the 
> keys need to
> be cryptographically separated. In the solutions document, 
> this then can be
> addressed in a way appropriate to the solution.
> 
>             jak
> 
> 
> 
> ----- Original Message ----- 
> From: "Yoshihiro Ohba" <[email-masked]>
> To: <[email-masked]>
> Cc: <[email-masked]>; <[email-masked]>
> Sent: Wednesday, February 23, 2005 4:41 PM
> Subject: Re: [Mip6] Security Section Comments
> ondraft-ietf-mip6-bootstrap-ps-01.txt
> 
> 
> > Hi John and James,
> >
> > I think that we might define which level of the keys for the two
> > services in the EAP key hierarchy needs to be cryptographically
> > separated (for simplicity let me assume that the keys are part
> > of EAP key hierarchy).
> >
> > It is always good to cryptographically separate keys 
> derived from the
> > EAP MK (Master Key) for network access service and keys derived from
> > the EAP MK for mobility service.  On the other hand, depending on
> > optimization level and deployment scneario, two EAP MKs may be the
> > same, meaning that cryptographic separation may not always 
> be possible
> > at the highest level of the EAP key hierarchy.
> >
> > Yoshihiro Ohba
> >
> >
> >
> > On Wed, Feb 23, 2005 at 07:23:16AM +0200, 
> [email-masked] wrote:
> > > Hi James,
> > >
> > > > Actually, I think we want to keep the keys separate even if the
> network
> > > > access provider and mobility service provider are the 
> same. From a
> security
> > > > standpoint, it makes sense to maintain separate keys, 
> so that if one
> is
> > > > compromised the other won't be.  I suppose one could 
> argue that "well,
> if
> > > > the network access service is compromised, the user is 
> so hosed, so it
> > > > really doesn't matter if mobility service is 
> compromised" but the othe
> way
> > > > around is something different. If the mobility service key is
> compromised,
> > > > the mobile host could stay put at the same place and 
> re-establish
> secure
> > > > mobility access service, as long as network access 
> service is not
> > > > compromised. If the two keys are the same, then the 
> mobile host must
> go
> > > > through re-establishing secure network access service 
> before mobility
> > > > service security can be repaired.
> > > >
> > > > Does this make sense? If so, perhaps the draft should 
> make this point
> > > > explicitly.
> > >
> > > I think we should make this point explicitly.  To modify 
> your proposed
> text:
> > >
> > > >> In addition to these attacks, there are other 
> considerations that are
> > > >> important in achieving a good security design. Because 
> mobility and
> network
> > > >> access authentication are separate services, any keys for these
> services
> > > >> need to be cryptographically separate, separately 
> named, and have
> separate
> > > >> lifetimes that are not exceeded. This is necessary 
> because a mobile
> host
> > > >> must be able to move from one serving (or roaming) 
> network access
> provider
> > > >> to another without needing to change its mobility 
> access provider.
> Finally,
> > > >> basic cryptographic processes must provide for 
> multiple algorithms in
> order
> > > >> to accommodate the widely varying deployment needs.
> > >
> > >  In addition to these attackes, there are other 
> considerstions that are
> important
> > >  in achieving a good security design. As mobility and 
> network access
> authentication
> > >  are seperate services, keys for these services need to be
> cryptographically
> > >  seperate, seperately named and have seperate lifetimes. 
> This is needed
> because
> > >  if one service is compromised, the other service is not. This is
> necessary
> > >  so that a mobile host can move from one serving (or 
> roaming) network
> access
> > >  provider to another without needing to change its mobility access
> provider.
> > >  Finally, basic cryptographic processes must provide for multiple
> algorithms in order
> > >  to accommodate the widely varying deployment needs.
> > >
> > > John
> > >
> > > _______________________________________________
> > > Mip6 mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/mip6
> >
> 
> 
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 25 Feb 2005 08:57:24 -0500

> both the network access & mobility service from sharing the same EAP master key?

I am not sure whether the current text prevents it or not, but it
would be clearer if we can mention that the keys that need to be
cryptographically separated are generated from authentication
credentials (i.e., are not the keys in the authentication
credentials), something like:

"
 In addition to these attackes, there are other considerstions that
 are important in achieving a good security design. As mobility and
 network access authentication are seperate services, keys generated
 from authentication credentials for these services need to be
 cryptographically seperate, seperately named and have seperate
 lifetimes. This is needed because if one service is compromised, the
 other service is not. This is necessary so that a mobile host can
 move from one serving (or roaming) network access provider to another
 without needing to change its mobility access provider. Finally,
 basic cryptographic processes must provide for multiple algorithms in
 order to accommodate the widely varying deployment needs.
"

Regards,

Yoshihiro Ohba

---

From: "James Kempf" <[email-masked]>
Date: Fri, 25 Feb 2005 09:08:44 -0800

Yoshi,

If the two sides use Diffie-Hellman, then the keys won't be generated
directly from authentication credentials. The Diffie-Hellman exponents don't
need to be related to authentication credentials at all.

Instead of:

"As mobility and network access authentication are seperate services, keys
generated from authentication credentials for these services need to be
cryptographically seperate, seperately named and have seperate lifetimes."

How about:

"As mobility and network access authentication are separate services, keys
generated for these services need to be cryptographically separate,
separately named, and have separate lifetimes, including if the keys are
generated from authentication credentials"

This doesn't imply somehow that the keys will always be generated from
authentication credentials.

            jak

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 25 Feb 2005 10:05:39 -0500

James,

I am fine with your suggested change.

Thank you.

Yoshihiro Ohba