1. Fast Roaming Compromise Proposal
May 2003
Fast Roaming Compromise Proposal
Tim Moore, Microsoft
Nancy Cam-Winget, Cisco Systems
Clint Chaplin, Symbol Technologies
Donald Eastlake, Motorola Laboratories
Dan Harkins, Trapeze Networks
Russ Housley, Vigil Security
Fred Stivers, Texas Instruments
Jesse Walker, Intel
Cam-Winget et. al.

2. Voice Requirements for reassociation
May 2003
Voice Requirements for reassociation
ITU guidance on TOTAL hand-off latency is that it should be less than 50 ms. Cellular networks try to keep it less than 35 ms.
Cam-Winget et. al.

3. Key Management Requirements
May 2003
Key Management Requirements
Explicitly identify the PMK and PMK type being used
Minimize computational load on all device types
Support multiple back-end infrastructures
Minimize the number of messages required while roaming.
Minimize time dependencies in key mgmt
Allow PTK pre-computation to accommodate highly constrained devices
Modifications to the information in the 4-way handshake can be made to address 1, 2 and 3 but not in 4, 5 and 6
Cam-Winget et. al.

4. Why not replace 4-way handshake?
May 2003
Why not replace 4-way handshake?
Because:
Generic mechanism for supporting PSK is needed
Industry is already deploying 4-way handshake and must be retained for backward compatibility
Define an optional proposal that allows coexistance with current TGi AKMs
Cam-Winget et. al.

5. Compromise Proposal Feature Requirement RSN SA
May 2003
Compromise Proposal
Feature
Requirement
RSN SA
Makes the notion of a session used to protect the data unique
Supports multiple backend infrastructures
Roaming Key Hierarchy (RKH)
Allows PTK precomputation
Minimize time dependencies in key mgmt
Minimize computational load on all device types
RKH IE
Minimize the number of message exchanges while roaming
Cam-Winget et. al.

6. RSN Security Association
May 2003
RSN Security Association
Defines the context to make the PTK usage meaningful
Default RSN SA
Class named by: AP’s BSSID and STA’s MAC address
PTK established by the 4-Way Handshake.
Instance named by ANonce and SNonce
The SA collapses when any party loses or discards the SA context
Alternate RSN SA
Class and instance named by:
MKID, AP’s BSSID and STA’s MAC address
PTK established by the R-PMK and R-PMK Counter
Cam-Winget et. al.

7. Root SA Pairwise Master SA RSN SA
May 2003
Roaming Key Hierarchy
PMK-EAP = f(MSK) EMSK is unused
Default Key Hierarchy
Roaming Key Hierarchy (RKH)
Unspecified means for
generating AP unique PMK’s
Root SA
(STA-AS)
MKID
Base Roam Key (BRK)
Pairwise Master Key (PMK) = Current radius derivation
Roaming Pairwise Master Key (R-PMK)
Pairwise Master SA
(STA-AP for Key Mgmt)
PTK = Current PTK derivation
R-PTK
RSN SA
(STA-AP for Data)
KCK
KEK TK
Cam-Winget et. al.

8. Fast Roam negotiation: new AKMs
May 2003
Fast Roam negotiation: new AKMs
OUI
Value
Meaning
Authentication Type
Key Management Type
00:00:00
Reserved 1
Unspecified authentication over IEEE 802.1X– RSN default
IEEE 802.1X Key Management as defined in 8.5 – RSN default 2
None
IEEE 802.1X Key Management as defined in 8.5 using PSK 3
Alternate Key Management - Optional 4
Unspecified authentication over IEEE 802.1X
5-255
Vendor Specific
Any
Other
Cam-Winget et. al.

9. RSN IE: Supports other back-end infrastructures
May 2003
RSN IE: Supports other back-end infrastructures
RSN IE Field
Length
Description
Element ID 1
0x30
RSN IE length
Version 2
RSN IE version
Group Key Ciphersuite 4
Selected ciphersuite for multicast
Pairwise Key Ciphersuite Count
Number of supported pairwise ciphersuites
Pairwise Key Ciphersuite list
4*n
List of supported pairwise ciphersuites
AKM count
Number of supported AKMs
AKM list
4*m
List of supported AKMs
Pairwise Key Hierarchy count
Number of supported Pairwise Key Hierarchies
Pairwise Key Hierarchy list
4*p
List of supported Pairwise Key Hierarchies
RSN Capabilities
RSN capabilities
Cam-Winget et. al.

10. Pairwise Key Hierarchies
May 2003
Pairwise Key Hierarchies
OUI
Value
Meaning
00:00:00
PSK 1
Default EAP PMK 2
EMSK Derived PMK (R-PMK)
3-255
Reserved
Vendor OUI
Other
Vendor Specific
Any
Cam-Winget et. al.

11. Rekeying Re-association
May 2003
Rekeying Re-association AP
STA
R-PMK, MKIDSTA, Counter1
R-PMK, MKIDAP, Counter2
Counter1 = Counter1 + 1,
R-PTK = KMIK | KMEK | TK = Roaming-PRF()
Re-assoc Req (RSN IE(AKMP), RKH IE(MKID, Counter1 , Srand, MIC, RSN IESTA))
Install TK for Rx
Install TK
Re-assoc Resp ( RKH IE(MKID, Counter2, Srand, Arand, RSC, EKMEK(GTK), MIC, RSN IEBSSID))
Install TK for Tx
EAPOL-Key( Arand, MIC)
Counter2 = Counter1
Cam-Winget et. al.

12. RSNIE – (RSN IE Length) bytes
May 2003
Rekeying Reassociations (2): Roaming Key Hierarchy IE
Element-ID – 1 byte
Length – 2 bytes
RSN IE Length – 1byte
GTK Key ID – 1 byte
GTK Length – 1 byte
MKID – 16 bytes
Counter – 4 bytes
SRandom – 16 bytes
ARandom – 16 bytes
RSC – 8 bytes
GTK – 40 bytes
MIC – 8 bytes
RSNIE – (RSN IE Length) bytes
Cam-Winget et. al.

13. Initial Association: 3-way handshake
May 2003
Initial Association: 3-way handshake
STA AP
MKID = AES-Encrypt(PMK, 0)
Counter1 = Counter1 + 1,
PTK-R = KMIK | KMEK | TK = Roaming-PRF()
APKM EAPOL Key** (0, 1, 1, 0, 0, 1, MKID, SNonce, MIC, RSNIESTA)
Install TK for Rx
Install TK
APKM EAPOL Key** (1, 1, 1, 1, 0, 1, MKID, SNonce, ANonce, MIC, RSNIEBSSID)
Install TK for Tx
APKM EAPOL-Key** ( 1, 1, 0, 1, 0, 1, ANonce, MIC, 0)
Counter2 = Counter1 Initiate GTK handshake
**APKM EAPOL Key is as defined in and uses Version Type 3 or 4
Cam-Winget et. al.

14. Supports Push and Pull Models
May 2003
Supports Push and Pull Models
In either Initial Contact or Roam:
If the AP does not have the RSN SA, it can contact the AS to establish it
Through prediction, the AP – AS can establish the RSN SA before the STA attempts reassociation
Cam-Winget et. al.

15. Motions Move to adopt draft text in 03/241r3
May 2003
Motions
Move to adopt draft text in 03/241r3
Move to request IEEE Working Group Chair to forward the letter titled “Input to IETF AAA Working Group on Keying Distribution Methods” to the IETF Chair
Cam-Winget et. al.

16. May 2003
Feedback?
Cam-Winget et. al.

17. Measured WPA values in ms
May 2003
Measured WPA values in ms
Message
Client
Dir AP
Total
Open Auth Request
0 - .3 ← .3
Open Auth Response →
.25 – 1.4
.25 – 1.7
Associate Request
1.75 – 5.6
Associate Response
.85 – 1.6
2.6 – 7.2
4-way Message 1
.8 - 4
3.4 – 11.2
4-way Message 2
19.4 – 261.2
4-way Message 3
21.9 – 289.2
4-way Message 4
34.9 – 367.2
GTK Message 1
6.9 – 122.6
41.8 – 489.8
GTK Message 2
(many retries)
51.3 – 576.5
Measurements were taken using Cisco 1200 APs with Intersil and Atheros NIC’s and MS and FUNK WPA Supplicants under ideal conditions (e.g. single client and little to no load on AP)
Cam-Winget et. al.