1. Robert Moskowitz, Verizon
May 2011
Project: IEEE P Working Group for Wireless Personal Area Networks (WPANs)
Submission Title: Key Management over 4e Multipurpose Frames
Date Submitted: May 10, 2011
Source: Robert Moskowitz, Verizon
Address 1000 Bent Creek Blvd, MechanicsBurg, PA, USA
Voice:+1 (248) ,
Re: Key Managementn over 4e Multipurpose Frames
Abstract: Using 4e Multipurpose Frames to provide for Key Mangement
Purpose: To add Key Management capabilities to 15.4
Notice: This document has been prepared to assist the IEEE P It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.
Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P
Robert Moskowitz, Verizon

2. Key Management over 15.4e Multipurpose Frames
May 2011
Key Management over 15.4e Multipurpose Frames
Robert Moskowitz
San Francisco
July 19, 2011
Robert Moskowitz, Verizon

3. Abstract To provide for a Key Management Protocol for 802.15.4
May 2011
Abstract
To provide for a Key Management Protocol for
KMP agnostic
Support: HIP, IKEv2, 802.1X, ...
Use the new Multipurpose Frames added via 15.4e for the transport of the KMP frames
Also Command Frames
Robert Moskowitz, Verizon

4. Discussion 4e Multipurpose Frame Adds flexibility to 15.4
May 2011
Discussion
4e Multipurpose Frame
Adds flexibility to 15.4
New functions without major standards revisions
Provides for Information Elements
Basic TLV – Type/Length/Value
Robert Moskowitz, Verizon

5. Discussion KMP Information Element KMP type 4bits (HIP, IKEv2, 802.1X)
May 2011
Discussion
KMP Information Element
KMP type 4bits (HIP, IKEv2, 802.1X)
Chaining flag 2 bits (no, yes, last)
Chaining REQUIRES frame ack
Chain count 6bits (multiple frames per KMP packet)
KMP payload
For HIP see IETF 5201-bis and HIP- DEX
Robert Moskowitz, Verizon

6. Discussion Short address for KMP frames (when HIP is KMP)
May 2011
Discussion
Short address for KMP frames (when HIP is KMP)
I1 always uses long addresses
HITs used derive short addresses
Low order 16 bits?
How to handle collisions?
Include short addresses in R1 over long addresses, THEN I2 over short addresses to handle collisions?
Robert Moskowitz, Verizon

7. May 2011
Discussion
BEACONLESS PANs are commonly deployed and thus first step in participation would be to KMP over Multipurpose frames.
BEACON PANs use ASSOCIATE Command Frames to start participation.
These frames can contain IEs so they would be used for KMP transport.
Robert Moskowitz, Verizon

8. Discussion HIT discovery and defense from Diffie- Hellman MITM attacks
May 2011
Discussion
HIT discovery and defense from Diffie- Hellman MITM attacks
Assume Initiator has no knowledge of Responders HIT for I1, so use I1 opportunistic mode (no Responder HIT)
Responder authenticates Initiator HIT
Pre-configured ACL
Restricted time window
Robert Moskowitz, Verizon

9. May 2011
Moving Forward
Create Recommended Practice document for KMP support as outlined
Include HIP DEX, IKEv2, and 802.1X guidelines
Allow for other KMPs defined elsewhere
Robert Moskowitz, Verizon

10. May 2011
Moving Forward
Work with IETF with 'mess under' to support KMP within a 15.4 mess?
E.G. to protect IPv6 Neighbor Discovery
Robert Moskowitz, Verizon