Subject: Comments on draft-ietf-pppext-eap-srp-03.txt

From: [email-masked]
Date: Mon, 16 Jul 2001 14:31:28 +0300

Hi James,

The new version looks pretty good to me. Many thanks!

I'm just about to leave for a vacation, and I only
have time for a quick comment. A security consideration about 
Step Two of section 3.2. occurred to me: Here the plaintext is the user 
identity, which an attacker might know. Can this known plaintext-ciphertext 
pair enable the attacker to compromize the key K? I don't know, 
I'm not familiar with this usage of SHA1.

As Jacques mentioned, it makes sense to use different keys for 
each purpose. We could use K for key derivations only, and derive 
a pseudonym hidding key, a link-layer packet security key and a 
lightweight re-authentication key from it. The AAA server would only
transport the packet security key the NAS, others would remain "end-to-end".
Therefore it would be impossible for the NAS to extract hidden pseudonyms 
or to fake lightweight re-authentications on behalf of the client. This 
would also restrict the implications of key compromises: for example even 
if the pseudonym hidding key was compromised, link layer packet security
or re-authentication would not be compromised. 

I think we could copy key derivation ideas from IKE (RFC 2409) or
TLS (RFC 2246).

Regards,
Henry