EAP Keying Framework
Draft-aboba-pppext-key-problem-06.txt
EAP WG
IETF 56
San Francisco, CA
Bernard Aboba
Goals & Objectives
• To provide a framework for evaluation of
EAP key derivation mechanisms and
transport mechanisms
– Terminology
– Key hierarchy overview
– Requirements for EAP methods, AAA
protocols and TSK derivation protocols
• Key derivation algorithms or mechanisms
are not specified in this document.
EAP Invariants
• Media independence
– EAP methods are designed to function on any lower
layer meeting criteria in RFC 2284bis, Section 3.1
• Ciphersuite independence
– Ciphersuite negotiation occurs out of band of EAP
– EAP methods generate Master Session Keys (MSKs)
that are suitable for use with any ciphersuite
• Method independence
– Pass-through authenticators cannot be assumed to
implement method-specific code
Master Key Types
• EAP Master Key (MK)
– A key derived between the EAP client and server that
is local to the EAP method and MUST NOT be
exported. Possession of other keys (MSK, TSKs,
TEKs, EMSK) MUST NOT provide information useful
in recovering the MK. The MK is proof of successful
authentication, and therefore may enable fast reauthentication (e.g. TLS session resume)
• Master Session Key (MSK)
– 64B of keying material that is derived between the
EAP client and server and exported by the EAP
method. Used in derivation of Transient Session Keys
(TSKs). Where a AAA server is present, the MSK is
transported between the AAA server and NAS. The
MSK allows a particular client to access the network
via a particular NAS.
Master Key Types (cont’d)
• Extended Master Session Key (EMSK)
– 64B of keying material that is derived between the EAP client
and server and exported by the EAP method. Use of the EMSK
is reserved, and it MUST NOT be transported by the AAA server
to the NAS. The EMSK MUST be cryptographically independent
from the MSK. The EMSK is the residue of successful
authentication, although possession does not enable fast reauthentication.
• Initialization Vector (IV)
– 64B derived between EAP client and server, optionally exported
by the EAP method, which is suitable for use in an initialization
vector. Due to export requirements the IV may be a known
quantity. Currently the IV is not used in either the two-way or
three-way exchanges.
Transient Key Types
• Transient EAP Keys (TEKs)
– Session keys used to provide protection for
portions of the exchange between the EAP
client and server. Not used to protect data.
• Transient Session Keys (TSKs)
– Session keys used to protect data sent
between the EAP client and NAS, derived
from the MSK via the TSK derivation protocol.
EAP Key Hierarchy
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
---+
|
|
^
|
EAP Method
|
|
|
|
|
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
| |
|
|
|
| |
|
|
|
| |
|
|
|
| |
EAP Master Key (MK)
|
|
|
| |
Derivation
|
|
|
| |
|
|
Local to |
| |
|
|
EAP |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
Method |
|
|
|
|
|
|
|
|
|
|
|
| MK
|
|
|
|
|
|
|
|
|
V
|
|
|
|
| +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ |
|
| | TEK
| | MSK
| |EMSK
| |IV
| |
|
| |Derivation | |Derivation | |Derivation | |Derivation | |
|
| +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+-+ |
|
|
|
|
|
|
|
|
|
|
|
|
V
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
---+
|
|
|
^
|
|
|
|
| MSK (64B)
| EMSK (64B)
| IV (64B)
|
|
|
|
Exported|
|
|
|
by |
|
V
V
EAP |
|
+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+ Method|
|
|
Reserved
| | Known
|
|
|
|
| |(Not Secret) |
|
|
+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+
V
|
---+
|
Transported |
|
by AAA |
|
Protocol |
V
V
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
---+
|
|
^
|
TSK
|
Ciphersuite |
|
Derivation
|
Specific |
|
|
V
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
---+
EAP Exchanges
• Two-way exchange
– EAP client and NAS, no AAA server.
– Popular in small networks (e.g. home AP)
– Usable in larger networks
• Certificate-based roaming
• IAPP-based fast handoff between APs to reduce load
• Three-way exchange
– EAP client, NAS and AAA server.
– Not usable in small networks.
– Most frequently deployed model for large networks.
Two-Way Exchange
+-+-+-+-+-+
+-+-+-+-+-+
|
|
|
|
|
|
|
|
| Cipher- |
| Cipher- |
| Suite
|
| Suite
|
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
^
^
|
|
|
|
|
|
V
V
+-+-+-+-+-+
+-+-+-+-+-+
|
|
|
|
|
|===============|
|
|
|EAP, TEK Deriv.|Authenti-|
|
|<------------->| cator
|
|
|
|
|
|
| TSK Deriv.
|
|
| peer
|<------------->| (EAP
|
|
|===============| server) |
|
| Link layer
|
|
|
| (PPP,IEEE802) |
|
|
|
|
|
|MSK,EMSK |
|MSK,EMSK |
| (TSKs) |
| (TSKs) |
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
^
^
|
|
| MSK, EMSK, IV
| MSK, EMSK, IV
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
|
|
|
|
| EAP
|
| EAP
|
| Method |
| Method |
|
|
|
|
|(MK,TEKs)|
|(MK,TEKs)|
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
Three-Way Exchange
+-+-+-+-+-+
+-+-+-+-+-+
|
|
|
|
|
|
|
|
| Cipher- |
| Cipher- |
| Suite
|
| Suite
|
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
^
^
|
|
|
|
|
|
V
V
+-+-+-+-+-+
+-+-+-+-+-+
+-+-+-+-+-+
|
|===============|
|========|
|
|
|EAP, TEK Deriv.|
|
|
|
|
|<-------------------------------->| backend |
|
|
|
|
|
|
|
| TSK Deriv.
|
| MSK
|
|
| peer
|<------------->|Authenti-|<-------| auth
|
|
|===============| cator
|========| server |
|
| Link Layer
|
| AAA
| (EAP
|
|
| (PPP,IEEE 802)|
|Protocol| server) |
|
|
|
|
|
|
|MSK,EMSK |
|
MSK
|
|MSK,EMSK |
| (TSKs) |
| (TSKs) |
|
|
|
|
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
+-+-+-+-+-+
^
^
|
|
| MSK, EMSK, IV
| MSK, EMSK, IV
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
|
|
|
|
| EAP
|
| EAP
|
| Method |
| Method |
|
|
|
|
|(MK,TEKs)|
|(MK,TEKs)|
|
|
|
|
+-+-+-+-+-+
+-+-+-+-+-+
The (Bermuda?) EAP Triangle
EAP peer
/\
/ \
Protocol: EAP
/
\
Protocol: TSK derivation
Auth: Mutual
/
\ Auth: Mutual
Unique keys: MK, /
\ Unique keys: TSKs
TEKs,EMSK
/
\
/
\
Auth. server +--------------+ Authenticator
Protocol: AAA
Auth: Mutual
Unique key: AAA session key
Security Requirements
• Mutual authentication at each leg of the triangle.
– Mutually authenticating EAP method
– TSK derivation protocol supporting mutual auth, secure
ciphersuite and capabilities negotiation
– Mutual authentication between NAS and AAA server
• Fresh session keys at each leg of the triangle
– EAP method provides fresh MSK, EMSK, IV
– No AAA static keys as in [RFC2865]
• RADIUS over IPsec
• Diameter over TLS/IPsec
– TSK derivation protocol guarantees freshness
• Keys protected from compromise
– Appropriate key strength (see [KeyLen])
– MK not derivable from other master or transient key types
– MSK transported securely from AAA server to NAS
• Established key wrap algorithms (not RFC 2548)
• Protection from compromise by AAA intermediaries
• Binding to correct session, NAS, client
Security Requirements (cont’d)
• Protection against man-in-the-middle attacks
• Per-packet authentication, integrity and replay
protection at each leg of the triangle
– EAP method
• Uses TEKs to provide security services
• Typically doesn’t cover EAP header or Identity, Notification,
Success/Failure packets
– AAA protocol
• Transmission layer security (IPsec, TLS)
• RFC 2869bis now has IPsec as a SHOULD
– TSK derivation protocol
• Example: IEEE 802.11i
Open Issues
• Issue 15: missing security reqts.
– Additional discussion of key naming, sychronization
and binding required
• Issue 47: key requirements unspecified
– Size of MSK and EMSK?
• Each is 64B at the moment
– Minimum key strength in some/all scenarios?
– Nonce exchange required in EAP methods?
• Issue 99: Double expansion
– Expansion typically occurs from MK to MSK and MSK
to TSK
– What is the effect of this?