Subject: [Anima] key management for MACsec

From: Michael Richardson <[email-masked]>
Date: Mon, 27 Mar 2017 15:31:58 -0400

Reading 802.1AE-2006, I did not see any key management protocol
for MACsec.  I was thinking before that maybe we could write a MACsec
key agreement mechanism in IKEv2.

I am now informed of 802.1Xbx-2014:
  Amendment 1: MAC Security Key Agreement
  Protocol (MKA) Extensions

but, I see that it's really an amendment to 802.1X, which I am fetching now.

My thought was that if there *wasn't* a key agreement protocol for MACsec,
that one could use IKEv2, and could propose a) MACsec, b) IPv6-over-IPsec,
c) GRE-over-IPsec, and let the normal IKEv2 process select which is
supported.   But, if MACsec already has a key agreement protocol, that
would be superfluous.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Hesham ElBakoury <[email-masked]>
Date: Mon, 27 Mar 2017 22:00:00 +0000

Mike,

802.1AE (MACsec) key management is specified in 802.1X-rev2 (2010).

Hesham

-----Original Message-----
From: Anima [mailto:[email-masked]] On Behalf Of Michael Richardson
Sent: Monday, March 27, 2017 12:32 PM
To: [email-masked]
Subject: [Anima] key management for MACsec

Reading 802.1AE-2006, I did not see any key management protocol for MACsec.  I was thinking before that maybe we could write a MACsec key agreement mechanism in IKEv2.

My thought was that if there *wasn't* a key agreement protocol for MACsec, that one could use IKEv2, and could propose a) MACsec, b) IPv6-over-IPsec,
c) GRE-over-IPsec, and let the normal IKEv2 process select which is
supported.   But, if MACsec already has a key agreement protocol, that
would be superfluous.

--
Michael Richardson <[email-masked]>, Sandelman Software Works  -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Mon, 27 Mar 2017 18:38:35 -0400

> 802.1AE (MACsec) key management is specified in 802.1X-rev2 (2010).

yes, I've come to understand that it's there.

    mcr> but, I see that it's really an amendment to 802.1X, which I am fetching
    mcr> now.

a) does it support stock PKIX certs for identities?
b) is this implemented widely?
c) are there major communities of users that essentially still use
   PSK to authenticate?

---

From: Hesham ElBakoury <[email-masked]>
Date: Tue, 28 Mar 2017 02:24:06 +0000

802.1X uses device certificates for mutual authentication.  I am not sure how wide spread the use of PSK is, 
but I suspect it is fairly large given the ease of set-up, implementation and test.  For sure it is the most common use in WiFi.

Hesham