Subject: [AAA-WG]: NAS-Session-Key AVP

From: Paul Funk <[email-masked]>
Date: Mon, 18 Mar 2002 23:29:43 -0500

I promised at the last IETF to present my thoughts on the key 
distribution AVPs in NASREQ. I am woefully late in doing so, and 
have not fully reviewed comments on the list, so if this is way off 
base or too late, please disregard with my apologies.

It seems to me that the NAS-Session-Key AVP with its multiple grouped 
components (direction, type, key, data, binding, etc.) is a doomed attempt 
to predict the ways people will want to use session keys in the future.

A simpler mechanism would be for keying information to be composed of 
exactly two items: key material and cipher suite. This approach takes its cue 
from TLS, and is both powerful and economical.

The key material is a byte sequence that may represent a single key or 
multiple keys in concatenated segments.

The cipher suite is a single value that encapsulates all information about 
the segmentation, interpretation and usage of the key material. 

Cipher suites are defined as needed, and may be as simple or complex as 
required. Cipher suite numbers would be given out by IANA, or vendors or 
industry groups could use their IDs to create their own. 

For example, cipher suite number 1 might mean 802.1X/WEP encryption, 
with key material consisting of a 32-byte of encryption key followed by a 
32-byte signature key. When, say, WEP-AES is developed, the 802.1X 
group applies for a new number, gets assigned cipher suite number 2, writes 
up a spec on what that means, and doesn't have to figure out how to describe 
their encryption scheme via AVPs like direction, type, binding, etc. Plus, all 
the NAS wants to know is whether to use WEP or WEP-AES, and would 
appreciate getting a single cipher suite number in the AAA response.

Cipher suites can also be negotiated between NAS and AAA server in a 
simple way. The NAS sends a list of supported cipher suites in preference 
order, the AAA server responds with its selection. 

Another advantage of this approach is that it is possible to make the AAA 
server completely ignorant of cipher suites. All the AAA server really needs 
to know is how to generate key material. The set of cipher suites sent by 
the NAS could include required length of key material. So if the server wants 
to be ignorant, all it has to do is select the first cipher suite suggested by 
the NAS and generate key material of the requested size.

The only AVP in the NASREQ draft that cannot be subsumed within keying 
material and cipher suite is Key-Lifetime. That would have to be a separate 
AVP determined by policy.

Paul

Paul Funk
Funk Software, Inc.
617 497-6339
[email-masked]