Distribution of EAP-Based Keys for Handover and Re-Authentication

Abstract

This document describes an abstract mechanism for delivering root keys from an Extensible Authentication Protocol (EAP) server to another network server that requires the keys for offering security protected services, such as re-authentication, to an EAP peer. The distributed root key can be either a usage-specific root key (USRK), a domain-specific root key (DSRK), or a domain-specific usagespecific root key (DSUSRK) that has been derived from an Extended Master

EAP Extensions for EAP Re-authentication Protocol (ERP)

“…The rMSK is transported in a manner similar to that of the MSK along with the EAP-Success message in a full EAP exchange. Ongoing work in [11] describes an additional key distribution protocol that can be used to transport the rRK from an EAP server to one of many different ER servers that share a trust relationship with the EAP server.…”

“…AAA Transport of ERP messages is specified in [11] and [12]. This section provides an analysis of the protocol in accordance with the AAA key management requirements specified in [18].…”

Analyzing EAP TLS and ERP Protocol with varying processor speed

“…802.1X makes the use of the Extensible Authentication Protocol (EAP) that defines how authentication messages are to be exchanged [12] between the various network components-clients (supplicants), switches or wireless access points (authenticators), and authentication servers. To optimize the performance of intra-domain re-authentication, some EAP methods have been designed such as the EAP-TLS, which is EAP integration [15] of the TLS protocol supporting either oneway or mutual authentication by using digital certificates. A per-session WEP key could be set up to implement the reauthentication and re-keyed on the peer.…”