Subject: Re: [Pana] PANA and lower layer ciphering

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 16 Jun 2005 13:16:28 -0400

On Wed, Jun 15, 2005 at 04:41:43PM -0700, Salowey, Joe wrote:
> 
> 
> 
> > Although PaC-EP master keys are cryptographically independent 
> > of each other and of PANA keys, PaC-EP master keys are 
> > cryptographically dependent on the AAA-Key because they are 
> > derived from AAA-Key.
> >
> 
> [Joe] The draft does not state that the PaC-EP master key is
> cryptographically independent of the PANA keys.  The best way to achieve
> this is to specify the derivation in this draft so that the keys are
> independent.  

I agree.

> 
> > > This would help eliminate
> > > the possibility that a AAA-key is used directly by a lower layer 
> > > protocol or that a lower-layer key is derived that is not 
> > > cryptographically independent from the PANA keys.  This should be 
> > > specified in the PANA protocol spec rather than trying to 
> > coordinate 
> > > it in multiple lower layer specs.
> > 
> > I believe that key derivation algorithms for PaC-EP master 
> > keys cannot be independent of lower layers, because lower 
> > layer parameters such as authenticator identifier would need 
> > to be bound to the master keys.
> > Thus, I think what we can describe in the PANA protocol spec 
> > is something like: "The PaC-EP master keys MUST be drived 
> > from the AAA-Key, bound to appropriate lower layer parameters 
> > and cryptographycally independent of each other".
> > 
> 
> [Joe] Why must they be bound to lower layer parameters?  This should be
> done in the lower layer instead of creating dependencies in PANA on the
> lower layer.  PANA exports a key and the lower layer is free to use it
> how it wishes, including deriving additional keys that have specific
> binding to lower layer parameters.

At least the PaC-EP master key needs to be associated with the
identity of the consumers (i.e., the PaC and EP) so that the PaC and
EP can make sure that which master key is used for which peer.

> 
> > > 
> > > If negotiation is necessary then why is the 
> > Protection-Capability AVP 
> > > only indicated by the PAA, shouldn't the PaC be able to 
> > indicate this 
> > > as well?
> > 
> > The current PANA design on this is that ciphering layer is 
> > not negotiable.  This is because if we allow multiple choices 
> > on ciphering layers, then it might end up with a situation 
> > where some PaC uses L3 ciphering while others use L2 
> > ciphering in the same access network, which might open up a 
> > security hole.
> > 
> 
> [Joe] Interesting, can you elaborate on this problem?  
> 

Assume that there are two EPs on a single IP link where one EP is an
WLAN AP using IEEE 802.11i and another EP is an access router using
IPsec.  Note that there is at least one open-access AP on the link to
make this work.  Then an unauthorized attacker may access the link via
open-access AP to launch L3 or higher layer attacks on the legitimate
PaCs that are using 802.11i.

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana