Re: EAP MSK: how is it transported between server and authenticator

Richard Chan wrote:

Simul-posting - tks! - I think that answers my question on what goes on in real deployments today.

I have a couple of quibbles though:

"You don't give the MSK to the NAS, that would defeat the entire point - MSK is private between the radius server and EAP client, and is used to derive further keys."

According to RFC5247 the MSK is potentially transported to the NAS in what it calls Phase Ib 'AAA Key transport'.

Yes sorry, as per my other email I am getting my terminology confused.