Forum

I have a couple of questions. I hope that experts could help me with them:

1. is an authentication server in 802.11i the same as a radius server? according to 802.11i, the authentication server sends master key (and pairwise master key), but how does a radius server know of (or compute) a master key? does it mean that an authentication server is an extension of a radius server? that is, we need to add more to radius server software code?

2. what is a session? when does a session start and end? how does 802.11i know about it? the standard (802.11i) did not define the notion of a session. could it be that a session is defined by time interval or data size? or a session is defined by a MAC (address) pair? speaking of this, how long are we going to keep all those temporal keys? if we don't keep the keys after some time, that would mean the session will be over by then.

Thanks.

First, remember that 802.11i is a bringing together of many other security techonologies such as EAP and 802.1x port-based authentication. Here are my best answers to your two questions:

1) A RADIUS server can act as the authentication server in an 802.11i aithentication scheme. RADIUS servers usually communicate with other authentication stores like Unix accounts or Microsoft's Active Directory in the case of IAS (Internet Authentication Servers - Microsoft's RADIUS). Th e master key can be derived or manually created. The pairwise master key is generated during the authentication process and then sent to the AP from the AS. From this time on, the AP and the STA communicate with each other using the PMK.

2) A session starts when authentication is complete and the and a security association (SA) has been created. The pairwise master key SA is created once a successful 802.1x/EAP negotiation has completed. Other SAs are dependent on this SA. The RADIUS server has the option of setting a lifetime for the SA or session when it is created. This is usually done by setting an EAP reauthentication timeout period.

I'd go into more detail, but it's Saturday morning and I'm late for my last golf outing of the year. Ask any clarifying questions you need and, I'm sure, others here in the forum will have input as well.

Tom Carpenter

thanks you very much for your expertise. it looks like that the session will not end if timeout is not set (it could be that timeout was a mandatory parameter).

this is what i saw in http://www.embedded.com/showArticle.jhtml?articleID=34400002

Radius is typically used between authenticator and authentication server.

A RADIUS server is a server that responds to RADIUS requests for authentication, accounting and authorization. THe papwer you referenced uses the term RADIUS for the protocol used between the anthenticator and the authentication server. If RADIUS is the protocol used, the server responding must support this protocol and, therefore, be a RADIUS server.

In reality, a RADIUS server may contain the authentication database internally or it may reference an external authentication database. For example, Microsoft's IAS service is usually configured to use an Active Directory (AD) database for credential storage. The RADIUS service (IAS) may be running on the domain controller (AD service) or it may be running on a separate machine.

Tom Carpenter

oh, i see, thanks!

Sorry if this is a hijack of the thread.

But I am not understanding the term Master Key with reference to 802.11i. I do understand PMK. I also have seen MK used when discusing Kerberos, but I do not believe that MK is even brought up in the CWSP study guide.

In most papers I have read the starting point has been the PMK. How it is derived is dependent on the whether an authentication framework is used or not.

Your comments would be very much appreciated.

802.11-REVma/D9.0 section 3.80: "master session key (MSK): Keying material that is derived between the Extensible Authentication Protocol (EAP) peer and exported by the EAP method to the Authentication Server (AS). This key is at least 64 octets in length."

I hope this helps. Thanks. /criss

Thanks Criss, but it does not really answer my question. In the CWSP study guide there is no reference to the MK. They mention that the PMK is the top of the proverbial heap if you will, page 429.

Other books reference the MK as what is sent through EAP channels to the Supplicant so that the PMK can be derived. The study guide mentions that process is what is used to create the PMK. Which ever one it is, it in essence is the only key that is actually transferred from the AS to the Supplicant, all of the rest are derived by the Supplicant or the AS. Knowing what is the actual methodology is seems like it would be important.

I sure would appreciate it if this could be cleared up.

That is correct M/Q.

On the CWSP book page 429, it says that PMK is derived from 802.1x/Eap process or through PSK passphrase.

Some other books mention Master Key is the one actually derived drom 802.1x/eap. Then this Master key generates PMK on the supplicant and Authenticator (No PMK on the Authentication server)

If I am not wrong, CWSP book does not mention that authenticator derives PMK as well. If authenticator has PMK, how this key is distributed by authentication server to the authenticator?

last thing is about session key. On page 303, it says that "Authentication server sends session key to Authenticator" and then "Authenticator sends supplicants broadcast key encrypted with session key". What is a session key in this context exactly? How a supplicant derives this session key from the first place?

Feedback is appreciated very much.

Thanks