EAP TTLS: Getting the EMSK key
Hi all, I am new to radius and am using it in for a wimax based EAP TLS/TTLS network. Right now, I have freeradius 1.1.7 already installed and working. What I need is to retrieve the calculated EMSK key (for testing purposes) from the radius server to the NAS. I have managed to get the MSK key, but for some reason I cannot retrieve the EMSK key. What do I need to do? Would upgrading to a newer version of freeradius help? Thanks, Daniel. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TTLS-Getting-the-EMSK-key-tp3354... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Daniel wrote:
I am new to radius and am using it in for a wimax based EAP TLS/TTLS network. Right now, I have freeradius 1.1.7 already installed and working.
It won't really work for WiMAX. You'll need 2.1.10, or maybe even the most recent git "master" branch.
What I need is to retrieve the calculated EMSK key (for testing purposes) from the radius server to the NAS. I have managed to get the MSK key, but for some reason I cannot retrieve the EMSK key. What do I need to do?
Edit the source code to export the EMSK. It's not *supposed* to be exported for security reasons.
Would upgrading to a newer version of freeradius help?
No. Alan DeKok.
Alan DeKok-2 wrote:
Daniel wrote:
I am new to radius and am using it in for a wimax based EAP TLS/TTLS network. Right now, I have freeradius 1.1.7 already installed and working.
It won't really work for WiMAX. You'll need 2.1.10, or maybe even the most recent git "master" branch.
It’s already working. I am running a full wimax network, and it’s running smoothly. Alan DeKok-2 wrote:
What I need is to retrieve the calculated EMSK key (for testing purposes) from the radius server to the NAS. I have managed to get the MSK key, but for some reason I cannot retrieve the EMSK key. What do I need to do?
Edit the source code to export the EMSK. It's not *supposed* to be exported for security reasons.
Can you please give me some kind of directions on how to do that? -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TTLS-Getting-the-EMSK-key-tp3354... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Daniel wrote:
It’s already working. I am running a full wimax network, and it’s running smoothly.
<shrug> If it works...
Can you please give me some kind of directions on how to do that?
Read the source code. src/modules/rlm_eap/libeap/* is a good start. Its an open source project, so developer documentation is rather limited. Alan DeKok.
Hi again, I have installed a clean new freeRadius 2.1.10 and set it up. It is working fine, and I am also receiving the MSK key (without doing any modifications to the code). How come I can get the MSK key, but not the EMSK? I would expect freeradius either to export both of them, or to not export both of them (for security reasons as you said). Thanks again, Daniel. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TTLS-Getting-the-EMSK-key-tp3354... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Daniel wrote:
I have installed a clean new freeRadius 2.1.10 and set it up. It is working fine, and I am also receiving the MSK key (without doing any modifications to the code).
As expected.
How come I can get the MSK key, but not the EMSK?
Because that's how it works.
I would expect freeradius either to export both of them, or to not export both of them (for security reasons as you said).
No. Go read the specifications. The EMSK is the master key. The MSK is a derived key. You can export derived keys, with minimal security problems. Exporting the master key is a major problem. In any case, this has nothing to do with FreeRADIUS. Go read the specs to see how the MSK and EMSK work. It's what *we* did. Alan DeKok.
participants (2)
-
Alan DeKok -
Daniel