RFC 6942
Diameter Support for the EAP Re-authentication Protocol (ERP)
RFC 6942: Diameter Support for the EAP Re-authentication Protocol (ERP) 💖
Okay bestie, let's get into RFC 6942 🦋 It's a Standards Track doc from May 2013 (ISSN 2070-1721). The authors are J. Bournelle and L. Morand from Orange Labs, S. Decugis from INSIDE Secure, Q. Wu from Huawei, and G. Zorn from Network Zen. Nothing in the header says it obsoletes or updates any other RFC, so it's just doing its own thing 💅
Abstract ✨
So ERP is the thing that adds extensions to EAP so a peer and an EAP Re-authentication (ER) server can re-authenticate efficiently through a compatible authenticator 🫶 This doc is all about Diameter support for ERP. It defines a brand-new Diameter ERP application to carry ERP messages between an ER authenticator and the ER server, plus a set of new Attribute-Value Pairs (AVPs) that transport the cryptographic material the re-authentication server needs. Main character energy 👑
Status of This Memo
This is an Internet Standards Track document 🎀
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741.
Info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc6942 🌸
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🔥
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 🙈
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. Requirements Language . . . . . . . . . . . . . . . . . . 4
3. Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Protocol Overview . . . . . . . . . . . . . . . . . . . . . . 5
5. Bootstrapping the ER Server . . . . . . . . . . . . . . . . . 6
5.1. Bootstrapping during the Initial EAP Authentication . . . 6
5.2. Bootstrapping during the First Re-authentication . . . . 8
6. Re-authentication . . . . . . . . . . . . . . . . . . . . . . 11
7. Application Id . . . . . . . . . . . . . . . . . . . . . . . 12
8. AVPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
8.1. ERP-RK-Request AVP . . . . . . . . . . . . . . . . . . . 13
8.2. ERP-Realm AVP . . . . . . . . . . . . . . . . . . . . . . 13
8.3. Key AVP . . . . . . . . . . . . . . . . . . . . . . . . . 13
8.3.1. Key-Type AVP . . . . . . . . . . . . . . . . . . . . 13
8.3.2. Keying-Material AVP . . . . . . . . . . . . . . . . . 13
8.3.3. Key-Name AVP . . . . . . . . . . . . . . . . . . . . 14
8.3.4. Key-Lifetime AVP . . . . . . . . . . . . . . . . . . 14
9. Result-Code AVP Values . . . . . . . . . . . . . . . . . . . 14
9.1. Permanent Failures . . . . . . . . . . . . . . . . . . . 14
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14
10.1. Diameter Application Identifier . . . . . . . . . . . . 14
10.2. New AVPs . . . . . . . . . . . . . . . . . . . . . . . . 15
10.3. New Permanent Failures Result-Code AVP Values . . . . . 15
11. Security Considerations . . . . . . . . . . . . . . . . . . . 15
12. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 16
13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 16
14. References . . . . . . . . . . . . . . . . . . . . . . . . . 16
14.1. Normative References . . . . . . . . . . . . . . . . . . 16
14.2. Informative References . . . . . . . . . . . . . . . . . 171. Introduction 🧚
Okay so Cao, et al. [RFC6696] is the one that defines the EAP Re-authentication Protocol (ERP). It's got the following steps:
- Bootstrapping: a root key for re-authentication gets derived from the Extended Master Session Key (EMSK) that was created during EAP authentication [RFC5295]. This root key is transported from the EAP server to the ER server.
- Re-authentication: a one-round-trip exchange between the peer and the ER server that ends in mutual authentication. To support this, ERP defines two new EAP codes,
EAP-InitiateandEAP-Finish💖
This document defines how Diameter transports the ERP messages during the re-authentication process. For that, we define a new Application Identifier for ERP and reuse the Diameter EAP commands Diameter-EAP-Request (DER) / Diameter-EAP-Answer (DEA) ✨
It also talks about how the root key gets distributed during bootstrapping, either along with the initial EAP authentication (implicit bootstrapping) or during the first ERP exchange (explicit bootstrapping). The security considerations for this key distribution are detailed in Section 7.4 of Salowey, et al. [RFC5295], so go read that if you're nervous about it 🙈
2. Terminology 🎀
This document uses terminology defined in Aboba, et al. [RFC3748], Salowey, et al. [RFC5295], Cao, et al. [RFC6696], and Eronen, et al. [RFC4072]. Iykyk.
Following RFC 5295, the term "domain" means a key management domain unless it's otherwise qualified. Similarly, "home domain" and "local domain" mean the same thing here as they do in RFC 6696 🦋
The re-authentication Domain-Specific Root Key (rDSRK) is a re-authentication Root Key (rRK) [RFC6696] that's derived from the Domain-Specific Root Key (DSRK) instead of the EMSK.
"Root key" (RK) or "bootstrapping material" refers to the rRK or rDSRK derived from an EMSK, depending on whether the ER server is located in the home or a foreign domain.
We use the notation "ERP/DER" and "ERP/DEA" in this document to mean Diameter-EAP-Request and Diameter-EAP-Answer commands with the Application Id set to <Diameter ERP> (Section 10.1). The same commands are called "EAP/DER" and "EAP/DEA" when the Application Id in the message is set to <Diameter EAP> [RFC4072] 🌈
2.1. Requirements Language 💅
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
3. Assumptions 🌸
This document assumes there's, at most, one logical ER server entity in a given domain. If several physical servers are deployed for robustness, a replication mechanism must be deployed to synchronize the ERP state (e.g., root keys) between these servers. That replication mechanism is outside the scope of this document 🙈
If multiple ER servers are deployed in the domain, we assume they can be used interchangeably. If multiple ER servers are deployed across multiple domains, we assume only one ER server, topologically close to the peer, is involved in ERP. Distance is measured in terms of Diameter hops 📏
This document also assumes there's, at most, one EAP server entity in the home domain. If there are multiple physical home EAP servers and the ER server wants to reach the same home EAP server, the ER server SHOULD cache the Destination-Host AVP corresponding to the home EAP server it requests 🧠
In general, it's assumed that key management domain names and Diameter realm names are identical for any given domain/realm. ✨
4. Protocol Overview 🦋
Here's the figure showing the components involved in ERP and how they interact 👀
Diameter +--------+
+-------------+ ERP +-----------+ (*) | Home |
Peer <->|Authenticator|<=======>| ER server | <---> | EAP |
+-------------+ +-----------+ | server |
+--------+
(*) Diameter EAP application; explicit bootstrapping scenario only.
Figure 1: Diameter ERP OverviewThe ER server is located either in the home domain (same as the EAP server) or in the local domain (same as the authenticator, when it differs from the home domain) 🏡
When the peer starts an ERP exchange, the authenticator creates a DER message [RFC4072]. The Application Id of the message is set to that of the Diameter ERP application (Section 10.1) in the message. The generation of the ERP/DER message is detailed in Section 6 💌
If there's an ER server in the same domain as the authenticator (i.e., the local domain), Diameter routing MUST be configured so this ERP/DER message reaches that server, even if the Destination-Realm is not the same as the local domain. This one's non-negotiable 🚨
If there's no local ER server, the message is routed according to its Destination-Realm AVP content, which is extracted from the realm component of the keyName-NAI attribute. As specified in RFC 6696, this realm is the home domain of the peer in the case of a bootstrapping exchange ('B' flag is set in ERP message), or the domain of the bootstrapped ER server otherwise 🧭
If there's no ER server available in the home domain either, the ERP/DER message can't be delivered. An error, DIAMETER_UNABLE_TO_DELIVER, MUST be generated as specified in RFC 6733, and returned to the authenticator. The authenticator MAY cache this information (with limited duration) to avoid further attempts to run ERP with this realm. It MAY also fall back to full EAP authentication to authenticate the peer 😭
When an ER server receives the ERP/DER message, it searches its local database for a valid, unexpired root key matching the keyName part of the User-Name AVP. If the key is found, the ER server processes the ERP message as described in RFC 6696, then creates the ERP/DEA answer as described in Section 6. The re-authentication Master Session Key (rMSK) is included in this answer 🔑
Finally, the authenticator extracts the rMSK from the ERP/DEA, as described in RFC 6696, and forwards the content of the EAP-Payload AVP, the EAP-Finish/Re-auth message, to the peer. ✨
The ER server may or may not possess the root key in its local database. If the EAP-Initiate/Re-auth message has its 'B' flag set (bootstrapping exchange) and the ER server does possess the root key, the ER server SHOULD respond directly to the peer that initiated the ERP exchange. Otherwise, the ER server SHOULD act as a proxy and forward the message to the home EAP server. Before forwarding, it changes its Application Id to Diameter EAP and adds the ERP-RK-Request AVP to request the root key. See Section 5 for more detail on this process 🫶
5. Bootstrapping the ER Server ✨
Bootstrapping is a team sport 🫶. The home EAP server and the ER server are both in it, but the peer and the authenticator get pulled in too. In ERP, the peer has to derive the same keying material as the ER server 🔑, which means it has to learn the ER server's domain name 🌸. How the peer finds that out is out of scope for this spec, but the authenticator might be set up to advertise the domain name, especially for re-authentication after a handover 🦋.
Bootstrapping an ER server with a given root key can happen in one of three moments: during the initial EAP authentication when the EMSK (the thing the root key gets derived from) is created, during the first re-authentication, or somewhere in between 👀. This spec only looks at the first two, in the subsections below.
5.1. Bootstrapping during the Initial EAP Authentication
Bootstrapping during the initial EAP authentication (also called implicit bootstrapping) is giving "ready when you are" 💅. The server is immediately available for the peer's re-authentication, so the re-auth delay gets squashed ✨. The catch is that only a small number of peers might actually use re-authentication in the local domain 🥲. Deriving and caching key material for every single peer, including the ones that don't support ERP, is a waste of resources, so we should avoid it 🙅♀️.
To make implicit bootstrapping happen, the ER server acts as a Diameter EAP Proxy, and Diameter routing MUST be configured so that Diameter EAP application messages are routed through this proxy 🚦. Here's the flow:
ER server &
Authenticator EAP Proxy Home EAP server
============= =========== ===============
------------------------->
Diameter EAP/DER
(EAP-Response)
------------------------->
Diameter EAP/DER
(EAP-Response)
(ERP-RK-Request)
<==================================================>
Multi-round Diameter EAP exchanges, unmodified
<-------------------------
Diameter EAP/DEA
(EAP-Success)
(MSK)
(Key AVP (rRK))
<-------------------------
Diameter EAP/DEA
(EAP-Success)
(MSK)
[ERP-Realm]
Figure 2: ERP Bootstrapping during Full EAP AuthenticationThe authenticator makes the first DER of the full EAP authentication and sends it over to the ER server 📨. The ER server proxies that first DER, sneaks the ERP-RK-Request AVP inside, and forwards it on to the home EAP server 🕵️♀️.
If the home Diameter server doesn't support the Diameter ERP extensions, it just ignores the ERP-RK-Request AVP and carries on as RFC 4072 [RFC4072] says 🤷♀️. If the server does support ERP, it saves the value of the ERP-Realm AVP found inside the ERP-RK-Request AVP and keeps going with the EAP authentication 💪. When the authentication wraps up, if it was successful and the EAP method generated an EMSK, the server MUST derive the rRK as specified in RFC 6696, using the saved ERP realm name 🔐. Then it puts the rRK inside a Key AVP (Section 8.3) with the Key-Type AVP set to rRK, and sends the DEA as usual 📬.
When the ER server proxies a Diameter-EAP-Answer message whose Session-Id matches a message it added an ERP-RK-Request AVP to, and the Result-Code is DIAMETER_SUCCESS, it MUST examine the message and save and remove any Key AVP (Section 8.3) with Key-Type AVP set to rRK 🧐. If the message doesn't have a Key AVP like that, the ER server may cache the fact that re-authentication via ERP isn't possible for the session, so it can skip future attempts 🙃. Either way, anything the ER server stores about a session should not have a lifetime longer than the EMSK for that session ⏳.
If the ER server got bootstrapped successfully, it should also add the ERP-Realm AVP after removing the Key AVP with Key-Type of rRK from the EAP/DEA message 🎀. That ERP-Realm info can be used by the authenticator to tell the peer that the ER server is bootstrapped, and which domain it's for 📣. How that info gets to the peer is outside the scope of this document 🤐. It needs to be sent to the peer if both implicit and explicit bootstrapping are possible, because the ERP message and the root key protecting it are different in bootstrapping exchanges versus non-bootstrapping ones 🧩.
5.2. Bootstrapping during the First Re-authentication
Bootstrapping during the first re-authentication (also called explicit bootstrapping) is only needed when there's no ER server in the local domain but there is one in the home domain 🏠. It's less resource-intensive, since the EMSK generated during the initial EAP authentication gets reused to derive root keys ♻️. The downside is that the first re-authentication needs a one-round-trip exchange with the home EAP server, because the EMSK is generated during the initial EAP authentication and never leaves the home EAP server 🛫. That makes it less efficient than implicit bootstrapping 😬.
The EAP-Initiate/Re-auth message goes to the home ER server 📤. The home ER server receives the ERP/DER message containing the EAP-Initiate/Re-auth message with the 'B' flag set 🚩. It builds a new EAP/DER message out of the received ERP/DER message and does the following:
- Set the Application Id in the header of the message to
<Diameter EAP>[RFC4072] 🏷️. - Extract the ERP-RK-Request AVP from the ERP/DER message, which contains the name of the domain where the ER server is located, and add it to the newly created ERP/DER message 📍.
Then the newly created EAP/DER gets sent and routed to the home Diameter EAP application server 🚀.
If the home Diameter EAP server doesn't support ERP extensions, EAP packets with an unknown ERP-specific code (EAP-Initiate) won't be understood 😵. In that case, the home Diameter EAP server MUST send an EAP/DEA with a Result-Code indicating a Permanent Failure (for example, DIAMETER_ERROR_EAP_CODE_UNKNOWN or DIAMETER_UNABLE_TO_COMPLY) 🚫. The Failed-AVP AVP MUST be included and contain a copy of the EAP-Payload AVP 📋. Otherwise, the server processes the DSRK request as described in RFC 6696 🛠️. In particular, it includes the Domain-Name TLV attribute with the content from the ERP-Realm AVP 🏷️. The server then creates the EAP/DEA reply message [RFC4072], including an instance of the Key AVP (Section 8.3) with the Key-Type AVP set to rRK, plus an instance of the Domain-Name TLV attribute with the content from the ERP-Realm AVP 💌.
The ER server receives this EAP/DEA and proxies it like this, on top of the usual proxy stuff 🔁:
- Set the Application Id back to Diameter ERP Application Id (Section 10.1) 🔙.
- Extract and cache the content of the Key AVP with Key-Type set to rRK, as described in Section 5.1). 💾
The ERP/DEA message then goes forward to the authenticator, which can use the rMSK as described in RFC 6696 🎉.
Here's how that proxy behaviour looks in a picture 🖼️:
Authenticator ER server Home Diameter server
============= ========= ====================
----------------------->
Diameter ERP/DER
(EAP-Initiate)
------------------------>
Diameter EAP/DER
(EAP-Response)
(ERP-RK-Request)
<------------------------
Diameter EAP/DEA
(EAP-Success)
(Key AVP (rRK))
(Key AVP (rMSK))
<----------------------
Diameter ERP/DEA
(EAP-Finish)
(Key AVP (rMSK))
Figure 3: ERP Explicit Bootstrapping Message Flow6. Re-authentication 🔄✨
okay bestie, this section walks through a re-authentication exchange with an ER server that was already bootstrapped 🫶 the figure below sums up the whole vibe
ER server
Peer Authenticator (bootstrapped)
==== ============= ======================
[ <------------------------ ]
[optional EAP-Initiate/Re-auth-start,]
[ possibly with ERP domain name ]
----------------------->
EAP-Initiate/Re-auth
===============================>
Diameter ERP, cmd code DER
User-Name: keyName-NAI
EAP-Payload: EAP-Initiate/Re-auth
<===============================
Diameter ERP, cmd code DEA
EAP-Payload: EAP-Finish/Re-auth
Key AVP: rMSK
<----------------------
EAP-Finish/Re-auth
Figure 4: Diameter ERP Re-authentication ExchangeThe peer sends an EAP-Initiate/Re-auth message to the ER server through the authenticator 📨 or, if it's feeling shy, the authenticator can send an EAP-Initiate/Re-auth-Start message to the peer to kick things off. In that case, the peer replies with an EAP-Initiate/Re-auth message 💅
If the authenticator doesn't support ERP (so it's pure Diameter EAP [RFC4072] support), it discards the EAP packets with an unknown ERP-specific code (EAP-Initiate) 🙈 the peer should fall back to full EAP authentication in this case, no drama.
When the authenticator gets an EAP-Initiate/Re-auth message from the peer, it processes the message as described in RFC 6696, with regard to the EAP state machine ⚙️ then it creates a Diameter ERP/DER message following the general process of Diameter EAP [RFC4072], with a few differences:
- The Application Id in the header is set to
<Diameter ERP>(code 13). - The value in the Auth-Application-Id AVP is also set to
<Diameter ERP>. - The keyName-NAI attribute from the ERP message is used to create the content of the User-Name and Destination-Realm AVPs.
- The Auth-Request-Type AVP content is set to the appropriate value.
- The EAP-Payload AVP contains the EAP-Initiate/Re-auth message.
Then this ERP/DER message gets sent as described in Section 4 🚀
The ER server receives and processes this request as described in Section 4 🧚 then it creates an ERP/DEA message following the general process described in Eronen, et al. [RFC4072], with a few differences:
- The Application Id in the header is set to
<Diameter ERP>(code 13). - The value of the Auth-Application-Id AVP is also set to
<Diameter ERP>. - The EAP-Payload AVP contains the EAP-Finish/Re-auth message.
- If authentication is successful, an instance of the Key AVP containing the rMSK derived by ERP is included 🔑
When the authenticator receives this ERP/DEA answer, it processes it as described in the Diameter EAP Application specification [RFC4072] and RFC 6696 🎀 the content of the EAP-Payload AVP is forwarded to the peer, and the contents of the Keying-Material AVP [RFC6734] are used as a shared secret for a secure association protocol specific to the lower layer in use. that's the whole handshake, iconic 🦋
7. Application Id 🪪
We define a new Diameter application in this document, Diameter ERP, with an Application Id value of 13 🌸 Diameter nodes that conform to this specification in the role of the ER server MUST advertise support by including an Auth-Application-Id AVP with a value of Diameter ERP in the Capabilities-Exchange-Request and Capabilities-Exchange-Answer commands [RFC6733].
The main reason for the Diameter ERP Application Id is to make sure messages get routed properly, and that the nodes advertising support for this application actually understand the new AVPs defined in Section 8 💖 those AVPs have the 'M' flag cleared, though.
8. AVPs 💎
The following subsections talk about the AVPs used by the Diameter ERP application.
8.1. ERP-RK-Request AVP 🗝️
The ERP-RK-Request AVP (AVP Code 618) is of type Grouped AVP. This AVP is how the ER server says it's willing to act as the ER server for a particular session 🙋♀️
This AVP has the 'M' and 'V' bits cleared.
ERP-RK-Request ::= < AVP Header: 618 >
{ ERP-Realm }
* [ AVP ]
Figure 5: ERP-RK-Request ABNF8.2. ERP-Realm AVP 🌍
The ERP-Realm AVP (AVP Code 619) is of type DiameterIdentity. It holds the name of the realm where the ER server is located.
This AVP has the 'M' and 'V' bits cleared.
8.3. Key AVP 🔐
The Key AVP [RFC6734] is of type Grouped and is used to carry the rRK or rMSK and its associated attributes 💜 how the Key AVP and its constituent AVPs get used in this application is spelled out in the subsections below.
8.3.1. Key-Type AVP
The value of the Key-Type AVP MUST be set to 1 for rRK or 2 for rMSK.
8.3.2. Keying-Material AVP
The Keying-Material AVP carries the rRK that the home EAP server sends to the ER server, in answer to a request containing an ERP-RK-Request AVP, or the rMSK that the ER server sends to the authenticator. How this material gets derived and used is specified in RFC 6696.
8.3.3. Key-Name AVP
This AVP contains the EMSKname that identifies the keying material. The derivation of this name is specified in RFC 6696.
8.3.4. Key-Lifetime AVP
The Key-Lifetime AVP contains the lifetime of the keying material in seconds ⏳ it MUST NOT be greater than the remaining lifetime of the EMSK the material was derived from. no going over, periodt 🙅♀️
9. Result-Code AVP Values 🚦
This section defines new Result-Code [RFC6733] values that MUST be supported by all Diameter implementations that conform to this specification 🫶
9.1. Permanent Failures ❌
Errors in the Permanent Failures category are used to tell the peer that the request failed, and it SHOULD NOT be attempted again 💀
DIAMETER_ERROR_EAP_CODE_UNKNOWN (5048): this error code is used by the Diameter server to tell the peer that the received EAP-Payload AVP contains an EAP packet with an unknown EAP code 🙈
10. IANA Considerations 📋
IANA has registered the following new elements in the Authentication, Authorization, and Accounting (AAA) Parameters registries [AAAPARAMS] 🗂️
10.1. Diameter Application Identifier
IANA has allocated a new value "Diameter ERP" (code: 13) in the "Application IDs" registry, from the "Standards Action" range of numbers, using the "Specification Required" policy [RFC5226]. See Section 11.3 of RFC 3588 [RFC3588] for further details.
10.2. New AVPs
IANA has allocated new values from the "AVP Codes" registry according to the policy specified in Section 11.1 of Fajardo, et al. [RFC6733] for the following AVPs:
- ERP-RK-Request (code: 618)
- ERP-Realm (code: 619)
These AVPs are defined in Section 8.
10.3. New Permanent Failures Result-Code AVP Values
IANA has allocated a new value from the "Result-Code AVP Values (code 268) - Permanent Failure" registry according to the policy specified in Section 11.3.2 of Fajardo, et al. [RFC6733] for the following Result-Code:
- DIAMETER_ERROR_EAP_CODE_UNKNOWN (code: 5048)
This Result-Code value is defined in Section 9.
11. Security Considerations 🛡️⚠️
The security considerations from the following documents apply here:
- Eronen, et al. [RFC4072]
- Salowey, et al. [RFC5295]
- Cao, et al. [RFC6696]
- Fajardo, et al. [RFC6733]
- Zorn, et al. [RFC6734]
🚨 this application sends sensitive data, including cryptographic keys, so it MUST be protected using Transport Layer Security (TLS) [RFC5246], Datagram Transport Layer Security (DTLS) [RFC6347], or IP Encapsulating Security Payload (ESP) [RFC4303]. If TLS or DTLS is used, the bulk encryption algorithm negotiated MUST be non-null. If ESP is used, the encryption algorithm MUST be non-null. null encryption is a hard no, bestie 🙅♀️💀
12. Contributors 🌟
Hannes Tschofenig wrote the initial draft of this document 🖋️
Lakshminath Dondeti contributed to the early drafts of the document 🌷
13. Acknowledgements 🙏
Hannes Tschofenig, Zhen Cao, Benoit Claise, Elwyn Davies, Menachem Dodge, Vincent Roca, Stephen Farrell, Sean Turner, Pete Resnick, Russ Housley, Martin Stiemerling, and Jouni Korhonen provided useful reviews 👑
Vidya Narayanan reviewed a rough draft version of the document and found some errors 🔍
Many thanks to these people! 🫶🌈
14. References 📚
14.1. Normative References
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H. Levkowetz, "Extensible Authentication Protocol (EAP)", RFC 3748, June 2004.
- [RFC4072] Eronen, P., Hiller, T., and G. Zorn, "Diameter Extensible Authentication Protocol (EAP) Application", RFC 4072, August 2005.
- [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
- [RFC5295] Salowey, J., Dondeti, L., Narayanan, V., and M. Nakhjiri, "Specification for the Derivation of Root Keys from an Extended Master Session Key (EMSK)", RFC 5295, August 2008.
- [RFC6696] Cao, Z., He, B., Shi, Y., Wu, Q., and G. Zorn, "EAP Extensions for the EAP Re-authentication Protocol (ERP)", RFC 6696, July 2012.
- [RFC6733] Fajardo, V., Arkko, J., Loughney, J., and G. Zorn, "Diameter Base Protocol", RFC 6733, October 2012.
- [RFC6734] Zorn, G., Wu, Q., and V. Cakulev, "Diameter Attribute-Value Pairs for Cryptographic Key Transport", RFC 6734, October 2012.
14.2. Informative References
- [AAAPARAMS] Internet Assigned Numbers Authority, "Authentication, Authorization, and Accounting (AAA) Parameters", <http://www.iana.org/assignments/aaa-parameters/>.
- [RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. Arkko, "Diameter Base Protocol", RFC 3588, September 2003.
- [RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303, December 2005.
- [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.
- [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer Security Version 1.2", RFC 6347, January 2012.
Authors' Addresses 🏡
Julien Bournelle
Orange Labs
38-40 rue du general Leclerc
Issy-Les-Moulineaux 92794
France
EMail: julien.bournelle@orange.com
Lionel Morand
Orange Labs
38-40 rue du general Leclerc
Issy-Les-Moulineaux 92794
France
EMail: lionel.morand@orange.com
Sebastien Decugis
INSIDE Secure
41 Parc Club du Golf
Aix-en-Provence 13856
France
Phone: +33 (0)4 42 39 63 00
EMail: sdecugis@freediameter.net
Qin Wu
Huawei Technologies Co., Ltd.
101 Software Avenue, Yuhua District
Nanjing, JiangSu 210012
China
EMail: sunseawq@huawei.com
Glen Zorn
Network Zen
227/358 Thanon Sanphawut
Bang Na, Bangkok 10260
Thailand
EMail: glenzorn@gmail.comthat's the whole spec, bestie! 🌈💅✨
📦 where this page comes from
- ietf: rfc6942 2013-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms