Subject: [eap] Issue 114: Terminology fixes

From: [email-masked] (Bernard Aboba)
Date: Sat, 26 Apr 2003 17:27:18 -0700 (PDT)

Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: April 25th, 2003
Reference:
Document: EAP-02
Comment type: T
Priority: S
Section: 1.2
Rationale/Explanation of issue:

Some terms aren't defined in the terminology section and there some minor
cleanup to do.

Change:

"authenticator
The end of the EAP link initiating the EAP authentication
methods. [Note: This terminology is also used in
[IEEE.802-1X.2001], and has the same meaning in this
document].

peer
The end of the EAP Link that responds to the authenticator.
[Note:In [IEEE.802-1X.2001], this end is known as the
Supplicant.]

backend authentication server
A backend authentication server is an entity that provides
an authentication service to an authenticator. When used,
this server typically executes EAP Methods for the
authenticator. [This terminology is also used in
[IEEE.802-1X.2001].]
"

To:

" authenticator
The end of the EAP link initiating EAP authentication.
The term Authenticator is used in
[IEEE.802-1X.2001], and has the same meaning in this
document.

peer
The end of the EAP Link that responds to the authenticator.
In [IEEE.802-1X.2001], this end is known as the
Supplicant.

backend authentication server
A backend authentication server is an entity that provides
an authentication service to an authenticator. When used,
this server typically executes EAP methods for the
authenticator. This terminology is also used in
[IEEE.802-1X.2001]."
Change:

" Key derivation
This refers to the ability of the EAP method to derive a
Master Key which is not exported, as well as a ciphersuite-
independent Master Session Keys. Both the Master Key and
Master Session Keys are used only for further key
derivation, not directly for protection of the EAP
conversation or subsequent data."

To:

" Key derivation
This refers to the ability of the EAP method to derive a
Master Key (MK) which is not exported, as well as
exportable keying material such as the Master Session Key
(MSK), Extended Master Session Key (EMSK) and (optionally)
an Initialization Vector (IV).

The MK, MSK and IV are used only for further key
derivation, not directly for protection of the EAP
conversation or subsequent data. Use of the EMSK
is reserved."

Change:

"Man-in-the-Middle resistance
The ability for the peer to demonstrate to the
authenticator that it has acted as the peer for each method
within the conversation. Similarly, the authenticator
demonstrates to the peer that it has acted as the
authenticator for each method within the conversation. If
this is not possible, then the authentication sequence or
tunnel may be vulnerable to a man-in-the-middle attack."

To:

"Man-in-the-Middle resistance
The ability for the peer to demonstrate to the
authenticator that it has acted as the peer for each
authentication method within the conversation. Similarly,
the authenticator demonstrates to the peer that it has
acted as the authenticator for each authentication method
within the conversation. If this is not possible, then
the authentication sequence or tunnel may be vulnerable
to a man-in-the-middle attack."

Change:

" Acknowledged result indications
The ability of the authenticator to provide the peer with
an indication of whether the peer has successfully
authenticated to it, and for the peer to acknowledge
receipt, as well as providing an indication of whether the
authenticator has successfully authenticated to the peer.
Since EAP Success and Failure packets are neither
acknowledged nor integrity protected, this claim requires
implementation of a method- specific result exchange that
is integrity protected."

To:

" Acknowledged result indications
The ability of the authenticator to provide the peer with
an indication of whether the peer has successfully
authenticated to it, and for the peer to acknowledge
receipt, as well as providing an indication of whether the
authenticator has successfully authenticated to the peer.
Since EAP Success and Failure packets are neither
acknowledged nor integrity protected, this claim requires
implementation of a method-specific result exchange that
is authenticated, integrity and replay protected on a
per-packet basis."

Add the following definitions:

"Cryptographic binding
The demonstration of the EAP peer to the EAP server that a single
entity has acted as the EAP peer for all methods executed within a
sequence or tunnel. Binding MAY also imply that the EAP server
demonstrates to the peer that a single entity has acted as the EAP
server for all methods executed within a sequence or tunnel. If
executed correctly, binding serves to mitigate man-in-the-middle
vulnerabilities.

Cryptographic separation
Two keys (x and y) are "cryptographically separate" if an adversary
that knows all messages exchanged in the protocol cannot compute x
from y or y from x without "breaking" some cryptographic
assumption. In particular, this definition allows that the
adversary has the knowledge of all nonces sent in cleartext as well
as all predictable counter values used in the protocol. Breaking a
cryptographic assumption would typically require inverting a one-
way function or predicting the outcome of a cryptographic pseudo-
random number generator without knowledge of the secret state. In
other words, if the keys are cryptographically separate, there is
no shortcut to compute x from y or y from x, but the work an
adversary must do to perform this computation is equivalent to
performing exhaustive search for the secret state value."

EAP Master key (MK)
A key derived between the EAP client and server during the EAP
authentication process that is purely local to the EAP method. The
MK MUST NOT be exported from the EAP method or be made available to
a third party. Since derivation of the MK is a residue of the
successful completion of the EAP authentication exchange, proof of
MK possession may be used to shorten future EAP exchanges between
the same EAP client and server, a technique known as "fast resume".

Master Session Key (MSK)
Keying material (64 octets) that is derived between the EAP client
and server. The MSK is used in the derivation of Transient Session
Keys (TSKs) for the ciphersuite negotiated between the EAP peer and
authenticator. Where a backend authentication server is present,
acting as an EAP server, it will typically transport the MSK to the
authenticator.

The MSK differs from the MK in that it not assumed to remain local
to the EAP method, and is known by all parties in the EAP exchange:
the peer, authenticator and the authentication server (if present).
The MSK MAY be derived from the MK via a one-way function, or it
may be an independent quantity. However possession of the MSK MUST
NOT provide any information useful in determining the MK.

Extended Master Session Key (EMSK)
Additional keying material (64 octets) derived between the EAP
client and server that is not assumed to remain local to the EAP
method. However, unlike the MSK, the EMSK is known only to the EAP
client and server and MUST NOT be provided to a third party. The
EMSK therefore MUST NOT be transported by the backend
authentication server to the authenticator. The EMSK is reserved
for future uses that are not defined yet. For example, it could be
used to derive additional keying material for purposes such as fast
handoff, man-in-the-middle vulnerability protection, etc. "

---

From: [email-masked] (Jari Arkko)
Date: Sun, 27 Apr 2003 20:39:39 +0300

I agree. --Jari

Bernard Aboba wrote:
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
> 
>