Re: [STDS-802-11-TGAZ] 11-20-168r2/CID 3170 - Passing encrypted PMKID (S

Thread Links	Date Links
Thread Prev	Thread Next	Thread Index	Date Prev	Date Next	Date Index

Just wanted to provide some rationale for my comments during today's conf. call to the group.

IETF RFC5869 that is the basis for deriving the secure TRNs says -

" Random salt differs fundamentally from the initial keying material in

   two ways: it is non-secret and can be re-used.  As such, salt values
   are available to many applications.  ...

   HKDF without having to protect the secrecy of the salt.  In a
   different application domain, a key agreement protocol deriving
   cryptographic keys from a Diffie-Hellman exchange can derive a salt
   value from public nonces exchanged and authenticated between
   communicating parties as part of the key agreement (this is the
   approach taken in [IKEv2])."

In STD 802.11 PMKID is exchanged (say in an Association Request) so that the receiver can find the correct PMK based

on the PMKID. PMKID is known to both sides in a secure ranging session and the PTKSA derived from the

same PMK that derives the PMKID (or PMKID otherwise bound to the PMK) protects the negotiation

exchange(s).

Passing PMKID in ranging negotiations (*FTM, LMR etc) is not required; if there is a PMK/PMKID

mismatch, it is not possible for the receiver to decrypt the secret key and the PMKID/Salt from the

encrypted *FTM/LMR (whose protection key is derived from the PTKSA (and PMK))

and use it in any way. The secret key is securely sent during the negotiations under PTKSA

protection and is used with the PMKID/Salt to compute the TRNs using HKDF defined

by RFC5869

Hope this helps.

Thanks,

- N

To unsubscribe from the STDS-802-11-TGAZ list, click the following link: https://listserv.ieee.org/cgi-bin/wa?SUBED1=STDS-802-11-TGAZ&A=1

Re: [STDS-802-11-TGAZ] 11-20-168r2/CID 3170 - Passing encrypted PMKID (Salt) in DMG/EDMG Ranging Negotiations