1. Keying for Fast Roaming
March 2003
Keying for Fast Roaming
Nancy Cam-Winget, Cisco Systems
Keith Amann, Spectralink
Bill Arbaugh, University of Maryland
Greg Chesson, Atheros
Dan Harkins, Trapeze
Russ Housley, Vigil Security
Fred Stivers, Texas Instruments
Jesse Walker, Intel Corporation
Cam-Winget et. al.

2. Agenda Concepts Fast Roaming Key Hierarchy Keying Reassociations
March 2003
Agenda
Concepts
Fast Roaming Key Hierarchy
Keying Reassociations
Fast Roaming PMK/PTK Usage
Protocol Properties
Back-end Protocol Considerations
Open Issues
Cam-Winget et. al.

3. Concepts AS-STA Session – MKID – Master Key Identifier, names a key
March 2003
Concepts
AS-STA Session –
MKID – Master Key Identifier, names a key
PMK Caching
PMK Timeout
PMK – unique per AP
Cam-Winget et. al.

4. Fast Roaming Key Hierarchy (1)
March 2003
Fast Roaming Key Hierarchy (1)
Master Key (MK) named MKID =
Original BSSID | STA MAC Addr | NTP Timestamp
Generate ETEK : End-To-End-Key is used to secure delivery of MKID
Pairwise Master Key (PMK) = Roaming-PRF(MasterKey, “fast roaming pmk” | MKID | BSSID)
PTK = Roaming-PRF(PMK, “fast roaming ptk” | new BSSID | STA MAC Addr | MKID | Counter)
Key Confirmation Key (KCK) – PTK bits 0–127
Key Encryption Key (KEK) – PTK bits 128–255
Temporal Key – PTK bits 256–n – can have ciphersuite-specific structure
Cam-Winget et. al.

5. Fast Roaming Key Hierarchy (2)
March 2003
Fast Roaming Key Hierarchy (2)
No random nonces mixed into PTK
Rationale: Allow STA to pre-compute PTK
Consequence: PMK must be fresh across AS-STA sessions
MKID identifies keys
Rationale: optimizing performance requires identifying right key earlier in key confirmation handshake
Cam-Winget et. al.

6. Fast Roaming Key Hierarchy (3)
March 2003
Fast Roaming Key Hierarchy (3)
Algorithm Roaming-PRF
Input: Key K, Label L, Nonce N, Output Length OL
Output: OL-octet string Out
Out = “”
for i = 1 to (OL+15)/16 do
Out = Out | AES-CBC-MAC(K, L | N | i | OL)
return first OL octets out of Out
Cam-Winget et. al.

7. Rekeying Reassociations (1)
March 2003 AP
STA
Rekeying Reassociations (1)
PMK, MKID1, Counter1
PMK, MKID2, Counter2
Counter1 = Counter1 + 1,
KCK | KEK | TK = Roaming-PRF(PMK, “fast roaming ptk” | BSSID | STA MAC Addr | MKID | Counter)
Reassoc Req (RSN IE, Fast-Rekey IE(MKID1, Counter1 , Srand))
if MKID1 == MKID2 and Counter1 > Counter2 then
derive KCK | KEK | TK
else reject
Reassoc Resp(RSN IE, Fast-Rekey IE(MKID2, Counter2, Arand, RSC, EKEK(GTK), MIC))
Action-Frame(Fast-Rekey-Confirm IE(Arand, MIC))
Install TK
Counter2 = Counter1
Install TK
Cam-Winget et. al.

8. Rekeying Reassociations (2): Fast-Rekey IE
March 2003
Rekeying Reassociations (2): Fast-Rekey IE
Element ID – 1 octet
Length – 1 octet
GTK Key ID – 1 octet
GTK Length – 1 octet
MKID – 20 octets
Counter – 4 octets
Random – 16 octets
RSC – 8 octets
GTK - 40 octets
MIC – 8 octets
Cam-Winget et. al.

9. Rekeying Reassociations (3): Fast-Rekey-Confirm IE
March 2003
Rekeying Reassociations (3): Fast-Rekey-Confirm IE
Element ID – 1 octet
Length – 1 octet
Random – 16 octets
MIC – 8 octets
Cam-Winget et. al.

10. Rekeying Reassociations (4): MICs
March 2003
Rekeying Reassociations (4): MICs
GTK encryption Algorithm: AES Key Wrapping (RFC 3394)
Pad with 16bytes of zeroes for CCMP
Reassociation Response MIC:
AES-CBC-MAC-64(KCK, Srand | RSNIEBSSID | Element ID | Length | MKID | Counter | Arand | RSC | GTK Key ID | GTK Length | GTK)
Action Message Confirm MIC:
AES-CBC-MAC-64(KCK, Element ID | Length | Arand)
The MIC’s effectively cover the entire Fast Rekey IE and must know MIC data length apriori.
Cam-Winget et. al.

11. Rekeying Reassociations (5)
March 2003
Rekeying Reassociations (5)
AP proves it is live by MICing SRand in Reassociation Response
STA proves it is live by MICing Arand in Action Message
Counter value rules insure PTK is fresh if PMK is fresh
STA must maintain Counter over MK lifetime
AP must maintain Counter over PMK lifetime
Cam-Winget et. al.

12. Rekeying Reassociations (6)
March 2003
Rekeying Reassociations (6)
AES-CBC-MAC requires Fast-Rekey IE, Fast-Rekey-Confirm IE have fixed lengths
Use only with TKIP and CCMP
Cam-Winget et. al.

13. Protocol Properties Scheme is optional Scheme works with
March 2003
Protocol Properties
Scheme works with
proactive keying (Arbaugh et al)
on-demand key refresh (Cam-Winget)
Scheme aids fast roaming by
Supporting PTK pre-computation
PMK caching at the AP and STA
Reducing roundtrips at reassociation from 7.5 to 2.5
Scheme is optional
Cam-Winget et. al.

14. Fast Roaming PMK/PTK Usage (1)
March 2003
Fast Roaming PMK/PTK Usage (1)
AS delivers PMK to AP Authenticator
802.1X Authenticator derives Fast-Roaming PTK
MAC asks 802.1X
to compute MICs over fast roaming rekey messages
to verify MICs of fast roaming rekey messages
to transfer RSC, encrypted GTK
Cam-Winget et. al.

15. Fast Roaming PMK/PTK Usage (2)
March 2003
Fast Roaming PMK/PTK Usage (2)
Service interface:
MLME-Compute-MIC
Indicates offsets for RSC, Encrypted GTK or if not requried
802.1X inserts RSC, GTK if non-zero offset
MLME-Verify-MIC
Indicates offsets for RSC, Encrypted GTK if present
802.1X extracts RSC, GTK if present
Service interface allows proprietary keying schemes, too
Cam-Winget et. al.

16. Fast Roaming PMK/PTK Usage (3)
March 2003
Fast Roaming PMK/PTK Usage (3)
Scheme requires AP to cache PMK, Counter across associations
AP can use server as backing store
AP selects random key K
AP uses K to encrypt PMK, Counter, PMK Timeout and save these in backing store data base indexed by STA MAC Addr
Scheme requires a PMK Timeout to always be present with the PMK
Cam-Winget et. al.

17. Fast Roam negotiation OUI Value Meaning Authentication Type
March 2003
Fast Roam negotiation
OUI
Value
Meaning
Authentication Type
Key Management Type
00:00:00
Reserved 1
Unspecified authentication over IEEE 802.1X– RSN default
IEEE 802.1X Key Management as defined in 8.5 – RSN default 2
None
IEEE 802.1X Key Management as defined in 8.5 using PSK 3
Unspecified authentication over IEEE 802.1X
Fast Roam Key Management - Optional
4-255
Vendor Specific
Any
Other
Cam-Winget et. al.

18. Initial Association AS STA AP March 2003 802.11 Open Authentication
Association Req + RSN IE (AKM = Fast Roam)
Association Response (success)
EAP type specific mutual authentication
AKM is relayed to AS using same back-end protocol (e.g. Radius attribute)
Derive Pairwise Master Key (PMK)
Access ACCEPT (MKID IE, PMK)
802.1X/EAP-SUCCESS
Counter = 1; Derive PTK
Cam-Winget et. al.

19. Initial Association STA AP March 2003
New Session Initiate ( MKIDE, RSNIEAP, Fast Rekey IE )
Counter ← 1
Derive PMK and PTK
New Session Confirm( RSNIESTA, Fast Rekey IE)
Install TK
Install TK
Cam-Winget et. al.

20. Initial Association(2): MKID IE
March 2003
Initial Association(2): MKID IE
Element ID – 1 octet
Length – 1 octet
MKID – 20 octets
MIC – 8 octets
Element shared between STA and AS only. ETEK is used to authenticate MKID:
MIC = AES-CBC-MAC(ETEK, Element ID | Length | MKID)
Cam-Winget et. al.

21. Initial Association (3)
March 2003
Initial Association (3)
New Session Initiate Fast Rekey IE :
MIC = AES-CBC-MAC(KCK, RSNIEBSSID | Element ID | Length | GTK Key ID | GTK Length | MKID | Counter | ARand | RSC | GTK)
New Session Confirm Fast Rekey IE:
MIC = AES-CBC-MAC(KCK, Element ID | Length | Arand)
Cam-Winget et. al.

22. Back-end Protocol Requirements
March 2003
Back-end Protocol Requirements
Must allow AP to specify roaming key hierarchy
Default = 4-way handshake hierarchy when unspecified
Must always support 4-way handshake, because STA may not support fast-roaming keying protocol
Must allow AS to deliver MKID, PMK, MKID IE timeout with PMK to APs within roaming domain
Cam-Winget et. al.

23. March 2003
Motion
Move to incorporate Fast Roaming Key Hierarchy and protocol from document 03/XXX into the TGi draft as optional.
Cam-Winget et. al.

24. Issues Under Discussion…all related to the backend
March 2003
Issues Under Discussion…all related to the backend
Which PMK to use on initial contact association?
AS and STA defines PMK to use in EAP exchange via EAP TLV.
How to deliver MKID to STA on initial contact?
AS delivers the MKID either through EAP TLV or on first initial contact handshake.
How does 802.1X AS know to generate the Fast Roaming PMK instead of 4-way Handshake PMK?
EAP TLV can be inserted in the EAP Identity Response of first STA challenge response. Otherwise, a new EAP method must be provided.
What are the PMK caching rules?
It is being addressed, one example is 03/084
Effect on 802.1X state machine?
Initial establishment is affected. New MLME interface is needed to allow .11 request new PTK.
Is rekey required? If so, how?
Issue holds for Fast Roam and 4-way handshake
Cam-Winget et. al.

25. March 2003
Feedback?
Cam-Winget et. al.