Subject: [Dime] Questions regarding RFC6924 Diameter Support for ERP

From: Avi Lior <[email-masked]>
Date: Wed, 09 Apr 2014 08:03:48 -0400

Hi folks

I was reading 6696 and 6924 (it's been awhile)  and I need clarification:

1) It appears that 6924 does not support transportation of DSRK key. 
Only rRK and rMSK.  Is that correct?

2) According to RFC 6696 - section 4.2:

RFC 6696: Section 4.2:

     o  The rRK MUST remain on the peer and the server that derived it
and MUST NOT be transported to any other entity.

So why is 6942 transporting the rRK around? 

Avi Lior

---

From: Qin Wu <[email-masked]>
Date: Thu, 10 Apr 2014 04:32:44 +0000

rRK is equivalent to rDSRK, See section 2:
"
The re-authentication Domain-Specific Root Key (rDSRK) is a
re-authentication Root Key (rRK) [RFC6696] derived from the Domain-
Specific Root Key (DSRK) instead of the EMSK.
"

RFC6942 support transportation of rDSRK. When ER server change, new rDSRK needs to be generated and transported to the new ER server.
The peer in RFC6696 is referred to ER client not Diameter Peer.

Regards!
-Qin
-----邮件原件-----
发件人: DiME [mailto:[email-masked]] 代表 Avi Lior
发送时间: 2014年4月9日 20:04
收件人: dime mailing list
主题: [Dime] Questions regarding RFC6924 Diameter Support for ERP

Hi folks

RFC 6696: Section 4.2:

     o  The rRK MUST remain on the peer and the server that derived it and MUST NOT be transported to any other entity.

Avi Lior

_______________________________________________
DiME mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dime

---

From: Qin Wu <[email-masked]>
Date: Tue, 15 Apr 2014 10:50:42 +0000

-----邮件原件-----
发件人: Avi Lior [mailto:[email-masked]] 
发送时间: 2014年4月12日 4:07
收件人: Qin Wu
抄送: dime mailing list
主题: Re: 答复: [Dime] Questions regarding RFC6924 Diameter Support for ERP

Hi Qin,

This is still confusing. Regarding quesiton 1: The way I understand the key hierarchy:

6696 key hierarchy derives ERP root key rRK from DSRK and calls is DS-rRK or from EMSK and calls it just rRK. And in general call at the ERP root keys rRK.

DSRK is defined by RFC 5295 and is not ERP specific.

[Qin]: Correct, DSRK may have other usages.

In 6942 rRK can be rDSRK which is DS-rRK as defined by 6696 or it can be rRK, the key derived directly from EMSK.

So DSRK is not the same as rDSRK. Did I get that right? 

[Qin]: I think rDSRK is derived from DSRK.

and thus 6942 does not appear to move DSRK.

[Qin]: RFC6696 can move DSRK from home EAP server to local ER server, see figure 2 of RFC6696. So does rDSRK.

Question 2 still remain unanswered. according to RFC 6696 the rRK - whether it is DS-rRK or rRK must not be transported from where it is derived. Yet 6942 transports it to other ERP entities. So why is RFC
6942 violating 6696?

[Qin]: My interpretation to your quoted text in RFC6696 is rRK or rDSRK will not be transported from ER server to authenticator only rMSK generated or derived from rRK or rDSRK at that ER server will be transported from that ER server to the ER authenticator. 

--
Avi Lior
======
h: +1.613.831.9031
m: +1.613.355.7112