Subject: [eap] question on the scope of the master session keys

From: [email-masked] (Clint Chaplin)
Date: Wed, 11 Jun 2003 10:09:49 -0700

Um, not quite.  There are four possible enumerated WEP keys, but the packet contains a number which states which WEP key was used.

But even the above is simplistic.  802.11 has the concept of key-mapping keys and default keys.  For unicast packets with a key index of zero, the key-mapping key space is searched for a key-mapping key that corresponds to the sending entity's MAC address, and if found, that key-mapping key is used, otherwise the default WEP key at key index 0 is used.  For all broadcast traffic and unicast traffic that used key indices 1 through 3, the corresponding default WEP key is used.

No trying of keys is needed, and in fact a lot of the existing hardware gives you only one chance to decrypt the message.

But, of course, this has nothing to do with the question you are asking.

Clint (JOATMON) Chaplin

>>> John Williams Floroiu <[email-masked]> 6/11/03 06:05:42 >>>

Hi,

According to my understanding, the link layer encryption (WEP) keys used by (802.11) access points to protect the data 
traffic are in number of four (and they are tried one-by-one until one or none matches). This basically means that the 
encryption keys are neither user nor device specific, but rather common to all clients that attach to a given access point.

However some phrasing like the one above, quoted from draft-ietf-eap-rfc2284bis-03.txt:

    [...] The MSK is used in the derivation of Transient
    Session Keys (TSKs) for the ciphersuite negotiated between
    the EAP peer and authenticator. [...]

suggest that the "authenticator" may configure EAP peer specific TSKs. Is this functionality envisioned to be supported 
by future access points?

Comments would be greatly appreciated.

John.

_______________________________________________
eap mailing list
[email-masked] 
http://mail.frascone.com/mailman/listinfo/eap 

________________________________________________________________________
This email has been scanned for computer viruses.

---

From: [email-masked] (John Williams Floroiu)
Date: Thu, 12 Jun 2003 10:56:42 +0200

Clint,

Thanks for the clarifications!

> But, of course, this has nothing to do with the question you are asking.

Well, it has somehow, because the key-mapping keys you mentioned are actually per-device keys.

John.