IETF-84 EMU TEAP Updates Nancy Joseph Salowey Hao Zhou Steve Hanna July 2012EMU WG1

draft-ietf-emu-eap-tunnel-method- 03 New version (03) submitted in June Several comments received on -02 All tickets have been resolved July 2012EMU WG 2

Changes from -02 SectionUpdates 3.3.3Clarified protected termination and use of crypto-binding TLV 3.5Changed Session ID to use tls-unique and added reference to RFC5247.RFC Added the use of tls-unique to the certificate enrollment request Modified Request-Action TLV to include Status code and optional TLVs. 3.4Clarified that all authenticated Peer-Ids need to be exported. 5.1Changed TLS Keying Material Exporter label to "teap seesion key seed". 5.2Changed Intermediate Compound Key Derivation from MSK to EMSK generated by inner method. 6Added missing IANA considerations. 7.3Added more security considerations for separation of Phase 1 and Phase 2 servers. Appendix CUpdated examples with Request-Action TLV, channel binding, and sending certificate after TLS renegotiation. July 2012EMU WG 3

EMSK in Crypto-Binding If Method generates an EMSK then it is used in the binding If method does not generate an EMSK then MSK is used If method does not generate MSK or EMSK then key is set to 0 (no key to bind to) July 2012EMU WG 4

Certificate Enrollment Use TLS-unique for binding Should we align with EST? – July 2012EMU WG 5

Next Steps Call for review and WGLC after IETF-84 July 2012EMU WG 6

Questions? July 2012EMU WG7