Subject: [AAA-WG]: Rewrite of Issue 397: No MSK Reservation

From: Bernard Aboba <[email-masked]>
Date: Fri, 21 Feb 2003 06:03:27 -0800 (PST)

I've rewritten this one, to improve clarity.

Issue 397: MSK Reservation
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: February 19, 2002
Reference:
http://mmlab.snu.ac.kr/research/publication/docs/pwc2002_shpack.pdf
Document: EAP-00
Comment type: Technical
Priority: S
Section:

The NASREQ-09 keying attributes allow keying material to be sent
to the NAS that may be needed to be kept on the AAA Server.

In RFC 2548, only 64 Bytes of the 128 Byte MSK are
transported. The rest remains on the AAA server. One question is how much
keying material is needed to be transported to provide keying material for
the link layer ciphersuite, and how much is exported by the EAP method,
but not transported.

If MSK(0,31) and MSK(32,63) are transported, then MSK(64,127) is the only
keying material exported by an EAP method that is known only by the
EAP client and server.

All the fast handoff proposals under discussion so far require a
"roaming key". The cryptographic properties of the roaming key vary
between proposals, but proposals providing Perfect Forward Secrecy (PFS)
require inputs that are known only by the EAP client and server. As noted
above, the only keying material exported by an EAP method that meets this
requirement is MSK (64,127). While it's not the purpose of Diameter EAP
to decide how fast handoff is done, it is a relevant question as
to whether MSK (64,127) needs to be "Reserved" for some reason, remaining
known only by the EAP client and server or whether this should also be
transported to the NAS.