RFC 5749
Distribution of EAP-Based Keys for Handover and Re-Authentication
Distribution of EAP-Based Keys for Handover and Re-Authentication 💖
- RFC number: 5749 🎀
- Authors: K. Hoeper (Ed.) and M. Nakhjiri from Motorola, plus Y. Ohba (Ed.) from Toshiba 👑
- Category: Standards Track
- ISSN: 2070-1721
- Date: March 2010 📅
- Obsoletes and updates: the title block doesn't list any RFCs that this one obsoletes or updates ✨
Abstract 🌸
okay so this doc describes an abstract mechanism for delivering root keys from an Extensible Authentication Protocol (EAP) server to another network server. That other server needs the keys to offer security-protected services, like re-authentication, to an EAP peer 🔐. The root key being distributed can be a usage-specific root key (USRK), a domain-specific root key (DSRK), or a domain-specific usage-specific root key (DSUSRK). All three are derived from an Extended Master Session Key (EMSK) hierarchy that was already set up between the EAP server and an EAP peer 🦋. The doc defines a template for a key distribution exchange (KDE) protocol that can send these different kinds of root keys over a AAA (Authentication, Authorization, and Accounting) protocol, and it also talks through the security requirements 🫶. The protocol template doesn't pin down message formats, data encoding, or other implementation details, so it has to be instantiated with a specific protocol (e.g., RADIUS or Diameter) before anyone can actually use it 💅.
Status of This Memo 📋
This is an Internet Standards Track document. ✨
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, received public review, and was approved for publication by the Internet Engineering Steering Group (IESG) 🎀. For more on Internet Standards, check Section 2 of RFC 5741 📚.
You can find info about the current status of this document, any errata, and how to give feedback on it at http://www.rfc-editor.org/info/rfc5749 🔗.
Copyright Notice ©️
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. 💜
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 📜. Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🌈.
This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people controlling the copyright in some of that material may not have granted the IETF Trust the right to allow modifications outside the IETF Standards Process 😬. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The exceptions are formatting it for publication as an RFC or translating it into languages other than English 🌍.
Table of Contents 📑
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Key Delivery Architecture . . . . . . . . . . . . . . . . . . 5
4. Key Distribution Exchange (KDE) . . . . . . . . . . . . . . . 6
4.1. Context and Scope for Distributed Keys . . . . . . . . . . 7
4.2. Key Distribution Exchange Scenarios . . . . . . . . . . . 8
5. KDE Used in the EAP Re-Authentication Protocol (ERP) . . . . . 8
6. Security Considerations . . . . . . . . . . . . . . . . . . . 9
6.1. Requirements on AAA Key Transport Protocols . . . . . . . 9
6.2. Distributing RK without Peer Consent . . . . . . . . . . . 10
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 10
8. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 10
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
9.1. Normative References . . . . . . . . . . . . . . . . . . . 10
9.2. Informative References . . . . . . . . . . . . . . . . . . 111. Introduction ✨
okay so EAP [RFC3748] is an authentication framework that supports authentication methods specified in EAP methods 💅. By definition, any key-generating EAP method derives a Master Session Key (MSK) and an Extended Master Session Key (EMSK) 🔑.
[RFC5295] reserves the EMSK for one job only: deriving root keys that get used for specific purposes called usages 🎀. It spells out how to make a usage-specific root key (USRK) for bootstrapping security in one application, a domain-specific root key (DSRK) for bootstrapping security for a set of services inside a domain, and a usage-specific DSRK (DSUSRK) for one application within a domain 🌸. [RFC5296] defines a re-authentication root key (rRK), which is a USRK designated for re-authentication 🦋.
The MSK and EMSK can be used to derive more keying material for a bunch of security mechanisms [RFC5247] 🧚. The MSK, for example, has been used a lot to bootstrap wireless link security associations between the peer and the network attachment points 📶. But performance and security issues pop up when you use the MSK and the current bootstrapping methods in mobile scenarios with handovers, as described in [RFC5169] 😭. To tackle handover latency and other shortcomings, [RFC5296] specifies an EAP re-authentication protocol (ERP). ERP uses keys derived from the EMSK or DSRK to make re-authentications efficient in handover scenarios 🚀.
Here's the tea: neither [RFC5295] nor [RFC5296] says how root keys get delivered to the network server that needs them 🙈. That delivery mechanism is essential, because the EMSK cannot leave the EAP server ([RFC5295]), but root keys are needed by other network servers that are separate from the EAP server 💔. For example, so an EAP peer can re-authenticate to a network during a handover, certain root keys have to be made available by the EAP server to the server carrying out the re-authentication 🫶.
This document specifies an abstract mechanism for delivering EMSK child keys from the server holding the EMSK or a root key to another network server. That other server asks for a root key so it can provide protected services (like re-authentication and other usage and domain-specific services) to EAP peers 💜. From here on, a server delivering root keys is called a Key Delivering Server (KDS), and a server authorized to request and receive root keys from a KDS is called a Key Requesting Server (KRS) 👑.
The Key Distribution Exchange (KDE) mechanism defined in this document runs over a AAA (Authentication, Authorization, and Accounting) protocol, e.g., RADIUS ([RFC2865], [RFC3579]) or Diameter [RFC3588] 🌈. It has several variants depending on the type of key being requested and delivered (i.e., DRSK, USRK, or DSUSRK) 🍓. The KDE mechanism presented here is a protocol template that must be instantiated for a particular protocol, such as RADIUS or Diameter, to specify the format and encoding of the abstract protocol messages. Only after that instantiation can the KDE mechanism described in this document be implemented 🛠️. This document also describes security requirements for secure key delivery over AAA 🔒.
2. Terminology 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💅. These are the words that tell you how strict something is, so read them carefully 🫶.
The following acronyms are used 📝.
AAA: Authentication, Authorization and Accounting. AAA protocols with EAP support include RADIUS ([RFC2865], [RFC3579]) and Diameter [RFC3588] 🦋.USRK: Usage-Specific Root Key. A root key derived from the EMSK; see [RFC5295] 🔑.USR-KH: USRK Holder. A network server authorized to request and receive a USRK from the EAP server. The USR-KH can be a AAA server or a dedicated service server 🌸.DSRK: Domain-Specific Root Key. A root key derived from the EMSK; see [RFC5295] 🌍.DSR-KH: DSRK Holder. A network server authorized to request and receive a DSRK from the EAP server. The most likely implementation of a DSR-KH is a AAA server in a domain, enforcing the policies for how the DSRK is used within that domain 👑.DSUSRK: Domain-Specific Usage-Specific Root Key. A root key derived from the DSRK; see [RFC5295] 🧚.DSUSR-KH: DSUSRK Holder. A network server authorized to request and receive a DSUSRK from the DSR-KH. The most likely implementation of a DSUSR-KH is a AAA server in a domain, responsible for a particular service offered within that domain 🍓.RK: Root Key. An EMSK child key, i.e., a USRK, DSRK, or DSUSRK 💜.KDS: Key Delivering Server. A network server that holds an EMSK or DSRK and delivers root keys to a KRS requesting them. The EAP server (together with the AAA server it exports the keys to for delivery) and the DSR-KH can both act as a KDS ✨.KRS: Key Requesting Server. A network server that shares an interface with a KDS and is authorized to request root keys from that KDS. A USR-KH, DSR-KH, and DSUSR-KH can all act as a KRS 🫶.HOKEY: Handover Keying 🦋.
3. Key Delivery Architecture ✨
okay so an EAP server does the normal EAP authentications with EAP peers, but it's usually NOT the one handling handovers and re-authentication for that same peer 🙈 that's where other servers come in. they can be AAA servers or other service network servers, and they're basically the helpers. 🧚 whenever EAP-based keying material is protecting a requested service, that keying material has to be available to whichever server is providing the service.
for example, the first time a peer asks a network server for a service, that server is acting as a KRS (key request server) 💜 it then asks the KDS (key distribution server) for the root keys it needs to derive the keys that protect the service. on later requests from the same peer, as long as the root key hasn't expired, the KRS can reuse those root keys to derive fresh keying material. 🔄
why all this request-and-deliver drama? because an EMSK can't leave the EAP server ([RFC5295]) 😭 so any root key that comes straight from an EMSK can only be derived by the EAP server itself. the EAP server then hands those keys to a server that can distribute them to the KRS. in the rest of this document, that combo (the EAP server that derives the root keys plus the AAA server that distributes them) is called the EAP/AAA server 🫶
root keys derived from EMSK child keys, like a DSUSRK, can be requested from the right root key holder instead. so a KDS can be either the EAP/AAA server or a DSRK holder (DSR-KH) 👑 and a KRS can be a USRK holder (USR-KH), a DSR-KH, or a DSUSRK holder (DSUSR-KH). it's giving layers, bestie 🎀
the KRS needs an interface with the KDS so it can send all the input data needed to derive the requested key, and so it can receive that key. the data it sends includes the Key Derivation Function (KDF) that should be used to derive the key 🔥 the KRS then takes the received root key and derives further keying material to secure its services. and every KDS is responsible for storing and protecting the root key it received, plus deriving and distributing any child key that comes from that root key 💅
here's an example of the whole setup, with the different KRS types and how they talk to the KDS:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| EAP/AAA server |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ | | \
/ | | \
/ | | \
+-+-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+ +-+-+-+-+-+
| USR-KH1 | | USR-KH2 | | DSR-KH1 | | DSR-KH2 |
| HOKEY server| | XYZ server| |Domain 1 | | Domain 2|
+-+-+-+-+-+-+-+ +-+-+-+-+-+-+ +-+-+-+-+-+ +-+-+-+-+-+
/ |
/ |
/ |
+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
| DSUSR-KH | | DSUSR-KH2 |
| Domain 1 | | Domain 2 |
|Home domain | |Visited domain |
|HOKEY server | |HOKEY server |
+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
Figure 1: Example Key Delivery Architecture for the Different KRS and
KDS4. Key Distribution Exchange (KDE) 🦋
in this section we get into a generic key distribution exchange (KDE) over AAA 🌸 the goal is to send a root key (RK) from a KDS down to a KRS. the communication path between them has to be protected by an appropriate AAA transport security mechanism (check Section 6 for the security requirements 🔒). the KRS and the KDS are treated as separate entities, logically if not physically, and the delivery of the requested RK is specified that way.
the whole exchange is one round-trip, so two messages total between the KRS and the KDS, as you can see in Figure 2 ✨
first, the KRS sends a KDE-Request carrying a Key Request Token (KRT) 💌 the KDS answers with a KDE-Response carrying a Key Delivery Token (KDT) 💌 both tokens ride inside AAA messages. how the AAA attributes are defined depends on which AAA protocol is implemented, and that's out of scope for this doc. the security requirements for AAA messages carrying KDE messages are covered in Section 6, so go read that 🫶 the KRT and KDT contents are defined right below.
KRS KDS
-------- -------
| |
| KDE-Request: AAA{KRT} |
|----------------------------------------->|
| KDE-Response: AAA{KDT} |
|<-----------------------------------------|
Figure 2: KDE Message FlowKRT : (PID, KT, KL) 💜
the KRT carries the identifiers of the peer (PID), the key type (KT), and the key label (KL) 🎀 the key type says which kind of root key is being requested, like DSRK, USRK, or DSUSRK. the encoding rules for each key type are up to the protocol developers who define how KDE works for their particular protocol. for key labels and their IANA registries, check out [RFC5295], which specifies key labels for USRKs and sets up an IANA registry for them. those same specs can be applied to other root keys too 🌈
KDT : (KT, KL, RK, KN_RK, LT_RK) 🍓
the KDT carries the root key (RK) being distributed to the KRS, plus the key type (KT), the key label (KL), the key name (KN_RK), and the lifetime of the RK (LT_RK) 💖 and here's the important bit: the key lifetime of each distributed key MUST NOT be greater than the lifetime of its parent key ⭐
4.1. Context and Scope for Distributed Keys 🌸
the key context of each distributed key is decided by the sequence of KTs in the key hierarchy 🦋 the key scope is decided by the sequence of (PID, KT, KL)-tuples in the key hierarchy, plus the identifier of the KRS ✨ the KDF used to generate the requested keys includes both the context and the scope info, so the key gets bound to that specific channel ([RFC5295]) 🔗
4.2. Key Distribution Exchange Scenarios 🌈
given the three types of KRS, there are three scenarios for distributing the EMSK child keys 💅 for all of them, the trigger and mechanism for key delivery can involve a specific request from an EAP peer, another intermediary (like an authenticator), or both. to keep things simple, it's assumed that USR-KHs live in the same domain as the EAP server 🏠
Scenario 1: EAP/AAA server to USR-KH: the EAP/AAA server delivers a USRK to a USR-KH 👑
Scenario 2: EAP/AAA server to DSR-KH: the EAP/AAA server delivers a DSRK to a DSR-KH 👑
Scenario 3: DSR-KH to DSUSR-KH: a DSR-KH in a specific domain delivers keying material to a DSUSR-KH in that same domain 👑
the key distribution exchanges for Scenario 3 can be combined with the ones for Scenario 2 into one single round-trip exchange, as shown in Figure 3 🔥 in this figure, KDE-Request and KDE-Response are the messages for Scenario 2, and KDE-Request' and KDE-Response' are the messages for Scenario 3 💜
DSUSR-KH DSR-KH EAP/AAA Server
-------- ------ ------------
| KDE-Request'(KRT') | KDE-Request(KRT) |
|------------------------>|-------------------------->|
| KDE-Response'(KDT') | KDE-Response(KDT) |
|<----------------------- |<--------------------------|
| | |
Figure 3: Combined Message Exchange5. KDE Used in the EAP Re-Authentication Protocol (ERP) 🧚
this section is about how the KDE mechanism should be used to request and deliver the root keys used for re-authentication in the EAP Re-authentication Protocol (ERP) defined in [RFC5296] 🦋 ERP supports two forms of bootstrapping, implicit and explicit, and KDE gets covered for both cases in the rest of this section ✨
in implicit bootstrapping, the local EAP Re-authentication (ER) server asks the home AAA server for the DSRK during the initial EAP exchange 💌 so here, the local ER server is the KRS and the home AAA server is the KDS 🫶 the local ER server includes a KDE-Request in the AAA packet that encapsulates the first EAP-Response message from the peer. here, an AAA User-Name attribute is used as the PID 💖 if the EAP exchange succeeds, the home AAA server includes a KDE-Response in the AAA message that carries the EAP-Success message 🎉
explicit bootstrapping is started by peers that don't know the domain 🥺 the peer sends an EAP-Initiate message with the bootstrapping flag turned on. then the local ER server (acting as the KRS) includes a KDE-Request in the AAA message carrying the peer's EAP-Initiate message, and sends it to the peer's home AAA server. again, an AAA User-Name attribute is used as the PID 🌸 in its response, the home AAA server (acting as the KDS) includes a KDE-Response in the AAA message that carries the EAP-Finish message, with the bootstrapping flag set ✨
6. Security Considerations 🔒
okay this part is SERIOUS bestie 😭 this section lays out the security requirements and talks about what happens when RK gets distributed without the peer's consent.
6.1. Requirements on AAA Key Transport Protocols 💀
any KDE attribute exchanged as part of a KDE-Request or KDE-Response MUST be integrity-protected and replay-protected by the underlying AAA protocol that's encapsulating those attributes 🛡️ on top of that, a secure key wrap algorithm MUST be used by the AAA protocol to protect the RK in a KDE-Response 🔐 other confidential info in the KDE messages (like identifiers, if privacy is a requirement) SHOULD be encrypted by the underlying AAA protocol 🙈
now here's the tea ☕ when there's an intermediary, like an AAA proxy, between the KRS and the KDS, there's a series of hop-by-hop security associations along the path. that means the intermediary on each hop can access the distributed keying material 😳 so hop-by-hop security SHOULD be limited to environments where the intermediary is trusted not to abuse the distributed key material 🤝 if a trusted AAA infrastructure like that doesn't exist, other means have to be applied at a different layer to make sure the end-to-end security (that's between the KRS and the KDS) of the exchanged KDE messages holds up 🧱 and the security requirements for such a protocol are the same as the ones already outlined for AAA protocols, which MUST hold when they're encapsulated in AAA messages 💜
6.2. Distributing RK without Peer Consent 💅
okay so this part is kinda spicy bestie 🙈 When a KDE-Request gets sent because of explicit ERP bootstrapping [RFC5296], the peer consent check for distributing an RK is covered by the integrity checksum on the EAP-Initiate message with the bootstrapping flag turned on. ✨ So the peer basically said yes with a checksum receipt 🧾
But when a KDE-Request gets sent because of implicit ERP bootstrapping [RFC5296], there is no cryptographic verification of peer consent for distributing an RK. 💀 The peer isn't involved in the process at all, so it has no idea that key delivery requests are happening for root keys derived from its established EAP keying material. Lowkey wild 😭
That means the peer has no control over where keys derived from its EAP keying material end up getting distributed. A possible consequence is that a KRS may request and obtain an RK from the home server even if the peer doesn't support ERP 🙃 Then the EAP-Initiate/Re-auth-Start messages sent to the peer get silently dropped, and that's just wasted resources piling up. Not iconic 💔
7. Acknowledgments 🫶
The editors would like to thank Dan Harkins, Chunqiang Li, Rafael Marin Lopez, and Charles Clancy for their valuable comments. Literal main character energy from these legends 👑
8. Contributors 🌸
The following people contributed to this document: Kedar Gaonkar, Lakshminath Dondeti, Vidya Narayanan, and Glen Zorn. Thank you queens 💖
9. References ✨
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, "Extensible Authentication Protocol (EAP)",
RFC 3748, June 2004.
[RFC5295] Salowey, J., Dondeti, L., Narayanan, V., and M. Nakhjiri,
"Specification for the Derivation of Root Keys from an
Extended Master Session Key (EMSK)", RFC 5295,
August 2008.
[RFC5296] Narayanan, V. and L. Dondeti, "EAP Extensions for EAP Re-
authentication Protocol (ERP)", RFC 5296, August 2008.9.2. Informative References
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)",
RFC 2865, June 2000.
[RFC3579] Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication
Dial In User Service) Support For Extensible
Authentication Protocol (EAP)", RFC 3579, September 2003.
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
Arkko, "Diameter Base Protocol", RFC 3588, September 2003.
[RFC5169] Clancy, T., Nakhjiri, M., Narayanan, V., and L. Dondeti,
"Handover Key Management and Re-Authentication Problem
Statement", RFC 5169, March 2008.
[RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible
Authentication Protocol (EAP) Key Management Framework",
RFC 5247, August 2008.Authors' Addresses 🦋
Katrin Hoeper (editor)
Motorola, Inc.
1295 E Algonquin Road
Schaumburg, IL 60196
USA
Phone: +1 847 576 4714
EMail: khoeper@motorola.com
Madjid F. Nakhjiri
Motorola, Inc.
6450 Sequence Drive
San Diego, CA 92121
USA
EMail: madjid.nakhjiri@motorola.com
Yoshihiro Ohba (editor)
Toshiba Corporate Research and Development Center
1 Komukai-Toshiba-cho
Saiwai-ku, Kawasaki, Kanagawa 212-8582
Japan
Phone: +81 44 549 2230
EMail: yoshihiro.ohba@toshiba.co.jp📦 where this page comes from
- ietf: rfc5749 2010-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms