Subject: RE: Using methods that derive keys

From: "Mohan Parthasarathy" <[email-masked]>
Date: Sat, 10 May 2003 18:55:45 -0700

:
> 
> > Hello, 
> > 
> > One of the requirements stated in the threats evaluation draft is :
> > 
> > PaC and PAA MUST mutually authenticate each other using 
> methods that can
> > derive 
> > keys which in turn can protect success and failure indications.
> > 
> > In the light of the recent discussion and comments, it will 
> be relaxed about
> > when 
> > success/failure can be protected. But there are other messages e.g.
> > transmitting 
> > the device identifier securely. This is done at the end and 
> hence can be
> > protected 
> > if keys are derived.
> > 
> > The issue is that it assumes that a certain EAP method is 
> used. Not all
> > methods 
> > can derive keys. So, we are indirectly mandating methods 
> that derive keys. Is
> > that okay ? In the past discussions, we wanted to avoid 
> this sort of thing.
> > But 
> > without extra protection, some of the attacks become possible now.
> 
> Key derivation, hence these type of EAP methods, are 
> necessary only in some
> environments, not all. So, we cannot generalize as PANA MUST 
> be used only
> when such methods are carried. Choice of authentication method is a
> deployment issue. As long as PANA knows how to carry those 
> methods, which it
> already does as these are just EAP methods, it satisfies the 
> requirement.
> 
> 
> Those attacks which requires methods that generates keys are 
> concern in
> shared wireless scenarios. Not in physically secured, or 
> already ciphered
> link-layers (e.g., cdma2000).
> 
We can't have two sets of requirements for the protocol. And
if shared wireless will be the most common scenario in the future,
PANA should be able to address it. Yes, being able to carry both
EAP methods will address it. But, the real difficulty i am having
here is coming up with requirements. Hmm.. may be all the requirements
should say

"PANA MUST be able to protect the device identifier"

"PANA MUST be able to prevent replay attacks".

And clarify what these requirements are trying to address in
the beginning. 

I think this is what i tried a few revisions back. But somehow
forgot about it :-) Can folks think of a better way to do this ?

-mohan

> > Comments ? 
> > -mohan

---

From: Alper Yegin <[email-masked]>
Date: Sat, 10 May 2003 20:30:33 -0700

> "PANA MUST be able to protect the device identifier"

Some additional text:

...This protection is required in shared links. In such networks,
authentication methods that are capable of generating cryptographic keys
must be used. PANA must be able to carry such authentication methods and use
the keys to protect the device identifier exchange.

Alper