Definition of Master Key between PANA Client and Enforcement Point
draft-ohba-pana-pemk-04

[Ballot discuss]
I have reviewed draft-ohba-pana-pemk-03, and have couple of
concerns/questions that I'd like to discuss before recommending
approval of the document:

- Using the address family numbers doesn't guarantee cryptographic
separation between different lower-layer protocols; for example,
802.11 and 802.16 use totally different security protocols, but share
the same address family number. And on top of the IPv4 address
family, you could run other things than IPsec.

However, an 802 address would still uniquely identify the EP, so I'm
not sure if this is a huge problem (and plain EAP without EAP channel
bindings doesn't provide even this much). But if the spec continues to use
address family numbers, at the very least the text about cryptographic
independence needs to be clarified.

- While the hash algorithm used for calculating PEMKname doesn't
really matter much security-wise, it's a bit strange to require MD5
here. Since RFC 5191 requires that all PANA implementations to
have the code for SHA-1, wouldn't that be a better choice?
(Either way, a normative reference for the algorithm is needed
here, too.)

[Ballot comment]
Why is draft-ohba-pana-pemk an individual submission when it is a WG document according to the writeup:

Working Group Summary

  This is an output of the PANA working group.

[Ballot comment]
Why is draft-ohba-pana-pemk an individual submission when it is a WG document according to the writeup:

Working Group Summary

  This is an output of the PANA working group.

[Ballot comment]
2.1.  Key Name of PEMK

  The key name of the PEMK is defined as follows.

  PEMKname = MD5(EPID | SID | KID), where MD5 denotes Message-Digest
  algorithm 5 hash function.

This needs a Normative reference to RFC defining MD5.

AD review:

I have reviewed this document with the idea of taking this on as an AD sponsored submission for Proposed Standard. I only had one minor editorial issue with it:

>    o  EPID is the identifier of the EP.  The first two octets represents
>      the AddressType, which contains an Address Family defined in
>      [IANAADFAM].

Is there a better reference for this than the IANA web page? An RFC perhaps? If you find a better reference please issue a new draft version.

Also, there's a bigger potential issue around the EMSK vs. MSK usage that we have already discussed earlier this year. In my own analysis I think the draft is doing the right thing -- MSK is already delivered to the PANA agent and already derived in one way to secure PANA itself. I see no problem in using it for the second time to derive a related key. However, I have asked the security ADs for advice on this issue, and maybe I'll be surprised on what they say. Stay tuned.