Subject: Re: security requirements

From: Paal Engelstad <[email-masked]>
Date: Wed, 20 Feb 2002 20:31:24 +0100

Alper,

> - anything on key distribution through PANA and using these keys with 
> link-layer mechanisms or IPsec???

IMO, yes and no:

IMO there will be an initial authentication method generating/distributing some general keying material (call it a "master session key"). From this keying material it is possible to derive keys for a number of purposes. Deriving keys for link-layer mechanisms or IPSec is out of scope of PANA, IMO. 

However, I think we must mention something about session-key-derivation for the re-authentication and disconnect algorithms. This is definitely within scope. 

But hopefully we will stay clear of this issue as much as possible. Seems like a slippery slope and a topic that PANA should try to keep away from. 

Paal

BTW: 
I think the main ideas expressed in draft-aboba-pppext-key-problem-01.txt is something this WG should take into consideration: We should not develop our own key-derivation algorithms, but re-use an existing one (if we need one).