On Fri, Oct 10, 2008 at 4:31 PM, Alan DeKok <aland@deployingradius.com> wrote:
Richard Chan wrote:
> After an EAP authentication which supports key derivation (MSK)
> how does freeradius transport the MSK to an NAS(authenticator)? I.e.,
> what kind of attribute is used?

 Run an EAP method.  Look in the Access-Accept for attributes named "key".

Can you provide a reference such an attribute defined? A glance through
http://freeradius.org/rfc/attributes.html doesn't show any "key" attributes
other than those related to MS-CHAP.

Are you referring to the attribute 'EAP-Master-Session-Key'
in http://tools.ietf.org/html/draft-aboba-radext-wlan-00#page-6. This attribute seems
to do exactly what I was asking but this draft  is superseded by a later version
which no longer provides an attribute to transfer MSKs.
http://www.ietf.org/internet-drafts/draft-aboba-radext-wlan-08.txt


> There is an IETF draft on encrypted RADIUS attributes (which
> specifically mentions "EAP MSK"):
> http://www.ietf.org/internet-drafts/draft-zorn-radius-encattr-14.txt
> but this seems too recent to be actually used in the field (besides
> including undefined magic numbers).

 It's not relevant.
Disagree - it explicitly suggests a way to transport wrapped MSKs between NAS and EAP Server.
How would you do it otherwise?
 
> Browsing another RADIUS server document (Cisco Secure ACS), there is a
> "RADIUS Key Wrap" secret
> that can be configured. Presumably this is used to send MSKs between
> server and authenticator,


 That's not relevant, either.
Disagree again - it's relevant insofar as it indicates that Cisco considers a need to do key wrapping between NAS
and EAP Server. Unfortunately the document doesn't explicitly mention that the 'RADIUS Key Wrap'
shared secret is used to encrypt MSKs nor does it explain how it is used.
 


> I couldn't find a
> similar configuration parameter in the
> freeradius config files, either radiusd.conf
> (http://wiki.freeradius.org/Radiusd.conf) or the client side (
> http://wiki.freeradius.org/Clients.conf).

 The MSK isn't configured.  It's mandated by the EAP method.
I was not referring to MSK (I know that this is an artifact of the EAP method). I was referring to the KEK that is
used to encrypt the MSK between FreeRADIUS and NAS.

 Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html