Subject: [eap] RE: Issue 113: Rewrite of Security Considerations Section

From: [email-masked] ([email-masked])
Date: Tue, 29 Apr 2003 16:26:02 +0300

> -----Original Message-----
> From: ext Bernard Aboba [mailto:[email-masked]]
> Sent: Tuesday, April 29, 2003 3:36 PM
> To: Eronen Pasi (NRC/Helsinki)
> Cc: [email-masked]
> Subject: RE: Issue 113: Rewrite of Security Considerations Section
 ...
> The EAP TLS IV derivation is taken from the TLS key=20
> hierarchy, which uses them with ciphersuites such as=20
> 3DES CBC mode. While the IVs are not a secret (this=20
> resulted from now-defunct export rules) they are=20
> based on the client and server nonces so they are live.

Yes, but we shouldn't repeat that mistake. CBC mode=20
is simply not secure enough for many applications=20
if the IVs are predictable (and TLS 1.1 drafts no
longer use predictable IVs).

So, considering that it seems that no ciphersuites
actually use the IVs yet, I propose we remove all=20
references to them from 2284bis, and just say
that an EAP method exports MSK and EMSK.

Best regards,
Pasi

---

From: [email-masked] (Bernard Aboba)
Date: Tue, 29 Apr 2003 10:47:21 -0700 (PDT)

> actually use the IVs yet, I propose we remove all

I agree.