1 / 8

AAA Support for ERP

AAA Support for ERP. draft-gaonkar-radext-erp-attrs (draft-dondeti-dime-erp-diameter) IETF-71, Philadelphia, PA. Things to do. ERP message transport via RADIUS/Diameter DSRK Request and Delivery rMSK delivery How to carry the request and the keys How to protect the delivery?

aideen
Download Presentation

AAA Support for ERP

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. AAA Support for ERP draft-gaonkar-radext-erp-attrs (draft-dondeti-dime-erp-diameter) IETF-71, Philadelphia, PA

  2. Things to do • ERP message transport via RADIUS/Diameter • DSRK Request and Delivery • rMSK delivery • How to carry the request and the keys • How to protect the delivery? • Inband vs. out of band

  3. Carrying ERP Messages over AAA • This part is easy • ERP messages are carried just as EAP messages • There are some straightforward details • NAS copies keyName-NAI TLV from EAP-Initiate/Re-auth into User-Name attribute/AVP • Specification of which ERP messages are carried in which AAA messages • Where unspecified, 3579 rules apply.

  4. Key Request and Transport • rMSK is transported using a RADIUS-attr TBD • Specify EAP rMSK as 2 (although it may be ok to reuse EAP MSK assignment for it) • For DSRK request and delivery using a RADIUS-attr TBD • Request and response piggybacked on AAA messages carrying EAP/ERP messages

  5. How to Encode the Req/Resp • Encode in a RADIUS attribute with • self-contained protection • Out of band protection • What do we need to consider? • NIST-approved algorithms • AES-KW • Algorithm agility • AES-KW or whatever else • The whatever else implies more signaling – combined modes are easier to signal • Multiple types of secure transport protocols • DTLS, IPsec etc.

  6. DSRK Request using Keywrap Type Length Reserved Enc Type Enc Type = 0 implies the use of AES-KW; The request does not need to be encrypted! App ID = EAP DSRK (number TBD) KEK ID = <NULL> KM ID = NULL@domain-name Lifetime = <NULL> IV = <NULL> Data = <NULL>

  7. DSRK Keywrap Type Length Reserved Enc Type App ID = EAP DSRK (number TBD) KEK ID = KEK_ID KM ID = EMSKname@domain-name Lifetime = Lifetime IV = IV Data = DSRK

  8. Questions?

More Related