Definition of Master Key between PANA Client and Enforcement Point
Extracted elements (15)
The document intentionally does not specify how a PaC discovers whether a lower layer requires a secure association protocol or how to bootstrap the pre-shared secret from PANA; this is left to each lower-layer protocol to define.
The EPID incorporates both an IANA Address Family number and the address value to guarantee cryptographic independence among PEMKs derived for EPs across different address families, preventing key reuse between, for example, IPv4 and IPv6 enforcement points.
The PEMK is defined separately from the MSK to ensure that each EP receives a distinct key, preventing compromise of one EP from exposing keying material usable at another EP even under the same PANA session.
The prf+ function used in PEMK derivation is defined in IKEv2 (RFC 4306), and the specific PRF algorithm is negotiated via the PRF-Algorithm AVP in PANA-Auth-Request, tying PEMK computation to the PANA session's negotiated cryptographic algorithm.
A PEMK MUST NOT be shared among multiple PaCs or EPs; one PEMK is used exclusively between one PaC and one EP.
A PEMK MUST NOT be used for any purpose other than as the pre-shared key of the secure association protocol within the scope of that PEMK.
The lifetime of a PEMK MUST be less than or equal to the lifetime of the MSK from which it is derived. At the end of the lifetime, the PEMK and its associated states MUST be deleted.
The security association used to distribute the PEMK between PAA and EP MUST be cryptographically bound to the identities of the PAA and EP as known to the PaC.
When distributing a PEMK from the PAA to a separate EP device, the key distribution protocol MUST ensure the PEMK is encrypted and both integrity and replay protected, using a security association between the PAA and EP.
The KID input to PEMK derivation is the content of the Key-ID AVP defined in RFC 5191, associated with the MSK used for derivation. The SID input is the 4-octet PANA Session Identifier from RFC 5191.
The PaC-EP Master Key (PEMK) is a 64-octet key derived as PEMK = prf+(MSK, "IETF PEMK" | SID | KID | EPID), using the prf+ function from IKEv2 (RFC 4306) with the PRF algorithm specified in the PRF-Algorithm AVP of the PANA-Auth-Request message with the 'S' bit set.
The PEMK key name is computed as PEMKname = SHA1(EPID | SID | KID), using SHA-1 as specified in FIPS PUB 180-2. Inclusion of EPID, SID, and KID guarantees uniqueness of PEMK names among multiple PaC-EP pairs under a given PAA.
Channel binding is achieved because the EP's device identifier (EPID) is incorporated into the PEMK key derivation function. A malicious EP advertising a different identifier than what is registered with the PAA will cause the secure association protocol to fail due to mismatched PEMK values.
When the EP resides on a separate device from the PAA, the PEMK distribution protocol must provide encryption, integrity protection, and replay protection. The PAA-EP security association must be cryptographically bound to identities known to the PaC to prevent man-in-the-middle attacks.
The EPID (Enforcement Point Identifier) field used in PEMK derivation consists of a 2-octet AddressType (containing an IANA Address Family number) followed by the address value whose length is determined by the AddressType.