Re: [Dan Harkins] comments on draft-houseley-aaa-key-mgmt-07.txt

[Lakshminath Dondeti <ldondeti at qualcomm.com>]

Dan Harkins wrote:
>   Sam,

>   But for things like HOKEY or 802.11r they want to have the AAA server
> create a key hierarchy rooted off the EMSK or the MSK, respectively, that
> contains keys for specific authenticators. These keys are going to be
> distributed using AAA (that seems to be the plan) and either proactively
> distributed-- "here have a key!"-- or distributed on demand-- "gimme a
> key!" The authenticator-specific key gets produced by mixing in some
> identity of the authenticator and that key is then sent under the
> protection of the security association between the AAA server and the
> authenticator.

Dan,

I snipped all the rest of the email so I can get a clarification from 
you on this particular paragraph.  The problem you describe here is that 
the authenticator gets a key based on the claimed identity of the 
authenticator.  If the peer and the server do not have a way to verify 
the identity of the authenticator it is a problem because the key that 
the server sends to the authenticator is the same as long as the claimed 
identity of the authenticator is the same.

Do I understand correctly?

thanks,
Lakshminath

_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf