Subject: Re: [Emu] Key derivation differences

From: David Mitton <[email-masked]>
Date: Wed, 11 Feb 2009 22:58:11 +0000 (GMT)

Earlier, I felt like asking if there were any independently developed implementations of EAP-FAST, now I see one.

And we see what gets discovered when you attempt interoperabilty testing with real running code.
Dave.

Feb 11, 2009 05:13:19 PM, [email-masked] wrote:

On Wed, Feb 11, 2009 at 01:29:34PM -0800, Bernard Aboba wrote:

> Are you suggesting that the version of EAP-MSCHAPv2 described in the document differs in terms
> of the MSK/EMSK derivation?  Or are you suggesting that further details are needed on how padding
> is accomplished with respect to ISK derivation?

Former (for MSK part) as far as using EAP-MSCHAPv2 inside EAP-FAST is
concerned (the document itself does not describe EAP-MSCHAPv2 MSK
derivation).

> In general, ISK derivation doesn't relate to an EAP method so much as the tunneling method that
> utilizes the keys exported by the inner method.  So if the issue is purely in the ISKs, then this
> doesn't really relate to EAP-FAST-MSCHAPv2 or EAP-MSCHAPv2 so much as to EAP-FAST
> provisioning mechanism.

What I noticed when implementing EAP-FAST and cryptobinding support for
EAP-PEAPv0 is that I have to swap the order of MS-MPPE send/recv keys
(i.e., swap octets 0..15 with 16..31) of the MSK from EAP-MSCHAPv2
between PEAPv0 and EAP-FAST uses in order to interoperate with other
implementations.

In other words, EAP-FAST and EAP-PEAPv0(with cryptobinding) seem to use
different derivation of ISK when using EAP-MSCHAPv2 as the inner method.
I do not see need for similar swapping of the ISK octets with EAP-TLS as
the inner method, so I would assume the difference is indeed in how the
EAP-MSCHAPv2 MSK derivation is defined. After reviewing the description
of the MS-CHAPv2 key derivation, I think I ended up agreeing with the
way this is done in PEAPv0+cryptobinding and the order used in deployed
EAP-FAST implementations would thus not match with the EAP-MSCHAPv2
definition for MSK derivation.

--
Jouni Malinen                                            PGP id EFC895FA
_______________________________________________
Emu mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/emu

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 11 Feb 2009 15:56:08 -0800

Just to make sure I understand this:

You are saying that in addition to the interoperability issues described in
Tim's note with respect to the EAP-FAST-MSCHAPv2, that this document
also does not conform to the key derivation specified in EAP MS-CHAPv2, 
and that as a result it can't interoperate with existing implementations of
EAP MS-CHAPv2, for regular non-provisioning uses?  

________________________________
> Date: Wed, 11 Feb 2009 22:58:11 +0000
> From: [email-masked]
> To: [email-masked]
> CC: [email-masked]; [email-masked]
> Subject: Re: Re: [Emu] Key derivation differences
>

---

From: Jouni Malinen <[email-masked]>
Date: Thu, 12 Feb 2009 10:49:04 +0200

> EAP MS-CHAPv2, for regular non-provisioning uses?  

I'm not sure I would go as far as saying it does not conform to a
specification taken into account the unclear situation on how MSK
derivation for EAP-MSCHAPv2 is defined. More exact statement would be
that EAP-FAST ISK and PEAPv0/cryptobinding ISK derivations use different
order of MS-MPPE-Send-Key and MS-MPPE-Recv-Key in the EAP-MSCHAPv2 MSK.

In other words, implementations that try to use the same EAP-MSCHAPv2
implementation (including the rules for MSK derivation) would not
interoperate with both deployed EAP-FAST and EAP-PEAPv0/cryptobinding
implementations. Depending on the Send/Recv key order in the MSK, one of
the tunnel methods using the MSK from EAP-MSCHAPv2 would need to swap
the keys. In my particular case, I ended up implementing EAP-FAST first
and found the issue when trying to interoperate with EAP-PEAPv0
cryptobinding after that.

As far as which use is correct is concerned, it is not exactly trivial
thing to figure out, but my current interpretation of various
specifications related to MS-MPPE keys is that the order used in
PEAPv0 cryptobinding would match with the order used in other methods.

Anyway, having a single document describing EAP-MSCHAPv2, including MSK
derivation, would be a useful thing to have for anyone who wants to
implement these things. The use of MS-MPPE Send/Recv keys that are
different for server and peer side instead of defining the same
derivation of full MSK for both server and peer make it very easy to get
this wrong. I ended up having to figure this out by testing against
deployed implementations and getting surprised that the same code does
not work with both uses.

Anyway, like I mentioned before, this EAP-MSCHAPv2 MSK difference is not
strictly speaking an issue that would be specific to
draft-cam-winget-eap-fast-provisioning; it would have been useful to
describe it in RFC 4851. Anyway, it looks like the authors are willing
to include the additional description in
draft-cam-winget-eap-fast-provisioning and for the goal of describing a
deployed protocol and allowing vendors to implement it in interoperable
way, it is useful to get this described somewhere and this draft looks
like the best place to do so at this point.