Download presentation
Presentation is loading. Please wait.
1
Fast Roaming Compromise Proposal
May 2003 Fast Roaming Compromise Proposal Tim Moore, Microsoft Nancy Cam-Winget, Cisco Systems Clint Chaplin, Symbol Technologies Donald Eastlake, Motorola Laboratories Dan Harkins, Trapeze Networks Fred Stivers, Texas Instruments Jesse Walker, Intel Cam-Winget et. al.
2
Voice Requirements for reassociation
May 2003 Voice Requirements for reassociation ITU guidance on TOTAL hand-off latency is that it should be less than 50 ms. Cellular networks try to keep it less than 35 ms. Cam-Winget et. al.
3
Key Management Requirements
May 2003 Key Management Requirements Explicitly identify the PMK and PMK type being used Minimize computational load on all device types Support multiple back-end infrastructures Minimize the number of messages required while roaming. Minimize time dependencies in key mgmt Allow PTK pre-computation to accommodate highly constrained devices Modifications to the information in the 4-way handshake can be made to address 1, 2 and 3 but not in 4, 5 and 6 Cam-Winget et. al.
4
Why not replace 4-way handshake?
May 2003 Why not replace 4-way handshake? Because: Generic mechanism for supporting PSK is needed Industry is already deploying 4-way handshake and must be retained for backward compatibility Define an optional proposal that allows coexistance with current TGi AKMs Cam-Winget et. al.
5
Compromise Proposal Feature Requirement RSN SA
May 2003 Compromise Proposal Feature Requirement RSN SA Makes the notion of a session used to protect the data unique Supports multiple backend infrastructures Roaming Key Hierarchy (RKH) Allows PTK precomputation Minimize time dependencies in key mgmt Minimize computational load on all device types RKH IE Minimize the number of message exchanges while roaming Cam-Winget et. al.
6
RSN Security Association
May 2003 RSN Security Association Defines the context to make the PTK usage meaningful Default RSN SA is defined by AP’s BSSID and STA’s MAC address PTK derived using the 4-Way Handshake. ANonce, SNonce The SA expiry, i.e., the conditions causing this SA to expire. Alternate RSN SA is defined by MKID, AP’s BSSID and STA’s MAC address R-PMK and R-PMK Counter used for PTK derivation Cam-Winget et. al.
7
Root SA Pairwise Master SA RSN SA Roaming Key Hierarchy
May 2003 Roaming Key Hierarchy PMK-EAP = f(MSK) EMSK is unused Default Key Hierarchy Roaming Key Hierarchy (RKH) Unspecified means for generating AP unique PMK’s Root SA MKID Base Roam Key (BRK) Pairwise Master Key (PMK) = Current radius derivation Roaming Pairwise Master Key (R-PMK) Pairwise Master SA PTK = Current PTK derivation R-PTK RSN SA KCK KEK TK Cam-Winget et. al.
8
Fast Roam negotiation: new AKMs
May 2003 Fast Roam negotiation: new AKMs OUI Value Meaning Authentication Type Key Management Type 00:00:00 Reserved 1 Unspecified authentication over IEEE 802.1X– RSN default IEEE 802.1X Key Management as defined in 8.5 – RSN default 2 None IEEE 802.1X Key Management as defined in 8.5 using PSK 3 Alternate Key Management - Optional 4 Unspecified authentication over IEEE 802.1X 5-255 Vendor Specific Any Other Cam-Winget et. al.
9
RSN IE: Supports other back-end infrastructures
May 2003 RSN IE: Supports other back-end infrastructures RSN IE Field Length Description Element ID 1 0x30 RSN IE length Version 2 RSN IE version Group Key Ciphersuite 4 Selected ciphersuite for multicast Pairwise Key Ciphersuite Count Number of supported pairwise ciphersuites Pairwise Key Ciphersuite list 4*n List of supported pairwise ciphersuites AKM count Number of supported AKMs AKM list 4*m List of supported AKMs Pairwise Key Hierarchy count Number of supported Pairwise Key Hierarchies Pairwise Key Hierarchy list 4*p List of supported Pairwise Key Hierarchies RSN Capabilities RSN capabilities Cam-Winget et. al.
10
Pairwise Key Hierarchies
May 2003 Pairwise Key Hierarchies OUI Value Meaning 00:00:00 PSK 1 Default EAP PMK 2 EMSK Derived PMK (R-PMK) 3-255 Reserved Vendor OUI Other Vendor Specific Any Cam-Winget et. al.
11
Rekeying Re-association
May 2003 Rekeying Re-association AP STA R-PMK, MKIDSTA, Counter1 R-PMK, MKIDAP, Counter2 Counter1 = Counter1 + 1, R-PTK = KMIK | KMEK | TK = Roaming-PRF() Re-assoc Req (RSN IE(AKMP), RKH IE(MKID, Counter1 , Srand, MIC, RSN IESTA)) Install TK for Rx Install TK Re-assoc Resp ( RKH IE(MKID, Counter2, Srand, Arand, RSC, EKMEK(GTK), MIC, RSN IEBSSID)) Install TK for Tx EAPOL-Key( Arand, MIC) Counter2 = Counter1 Cam-Winget et. al.
12
RSNIE – (RSN IE Length) bytes
May 2003 Rekeying Reassociations (2): Roaming Key Hierarchy IE Element-ID – 1 byte Length – 2 bytes RSN IE Length – 1byte GTK Key ID – 1 byte GTK Length – 1 byte MKID – 16 bytes Counter – 4 bytes SRandom – 16 bytes ARandom – 16 bytes RSC – 8 bytes GTK – 40 bytes MIC – 8 bytes RSNIE – (RSN IE Length) bytes Cam-Winget et. al.
13
Initial Association: 3-way handshake
May 2003 Initial Association: 3-way handshake STA AP MKID = AES-Encrypt(PMK, 0) Counter1 = Counter1 + 1, PTK-R = KMIK | KMEK | TK = Roaming-PRF() APKM EAPOL Key** (0, 1, 1, 0, 0, 1, MKID, SNonce, MIC, RSNIESTA) Install TK for Rx Install TK APKM EAPOL Key** (1, 1, 1, 1, 0, 1, MKID, SNonce, ANonce, MIC, RSNIEBSSID) Install TK for Tx APKM EAPOL-Key** ( 1, 1, 0, 1, 0, 1, ANonce, MIC, 0) Counter2 = Counter1 Initiate GTK handshake **APKM EAPOL Key is as defined in and uses Version Type 3 or 4 Cam-Winget et. al.
14
Motions Move to adopt draft text in 03/241r3
May 2003 Motions Move to adopt draft text in 03/241r3 Move to request IEEE Working Group Chair to forward the letter titled “Input to IETF AAA Working Group on Keying Distribution Methods” to the IETF Chair Cam-Winget et. al.
15
May 2003 Feedback? Cam-Winget et. al.
16
Measured WPA values in ms
May 2003 Measured WPA values in ms Message Client Dir AP Total Open Auth Request 0 - .3 ← .3 Open Auth Response → .25 – 1.4 .25 – 1.7 Associate Request 1.75 – 5.6 Associate Response .85 – 1.6 2.6 – 7.2 4-way Message 1 .8 - 4 3.4 – 11.2 4-way Message 2 19.4 – 261.2 4-way Message 3 21.9 – 289.2 4-way Message 4 34.9 – 367.2 GTK Message 1 6.9 – 122.6 41.8 – 489.8 GTK Message 2 (many retries) 51.3 – 576.5 Measurements were taken using Cisco 1200 APs with Intersil and Atheros NIC’s and MS and FUNK WPA Supplicants under ideal conditions (e.g. single client and little to no load on AP) Cam-Winget et. al.
Similar presentations
