-
Notifications
You must be signed in to change notification settings - Fork 2
/
draft-ietf-emu-rfc5448bis-08.txt
2744 lines (1859 loc) · 112 KB
/
draft-ietf-emu-rfc5448bis-08.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Network Working Group J. Arkko
Internet-Draft V. Lehtovirta
Obsoletes: 5448 (if approved) V. Torvinen
Updates: 4187 (if approved) Ericsson
Intended status: Informational P. Eronen
Expires: May 3, 2021 Independent
October 30, 2020
Improved Extensible Authentication Protocol Method for 3GPP Mobile
Network Authentication and Key Agreement (EAP-AKA')
draft-ietf-emu-rfc5448bis-08
Abstract
The 3GPP Mobile Network Authentication and Key Agreement (AKA) is the
primary authentication mechanism for devices wishing to access mobile
networks. RFC 4187 (EAP-AKA) made the use of this mechanism possible
within the Extensible Authentication Protocol (EAP) framework. RFC
5448 (EAP-AKA') was an improved version of EAP-AKA.
This memo replaces the specification of EAP-AKA'. EAP-AKA' was
defined in RFC 5448 and updated EAP-AKA RFC 4187. As such this
document obsoletes RFC 5448 and updates RFC 4187.
EAP-AKA' differs from EAP-AKA by providing a key derivation function
that binds the keys derived within the method to the name of the
access network. The key derivation function has been defined in the
3rd Generation Partnership Project (3GPP). EAP-AKA' allows its use
in EAP in an interoperable manner. EAP-AKA' also updates the
algorithm used in hash functions, as it employs SHA-256 / HMAC-
SHA-256 instead of SHA-1 / HMAC-SHA-1 as in EAP-AKA.
This version of EAP-AKA' specification specifies the protocol
behaviour for both 4G and 5G deployments, whereas the previous
version only did this for 4G.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Arkko, et al. Expires May 3, 2021 [Page 1]
Internet-Draft EAP-AKA' October 2020
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on May 3, 2021.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements Language . . . . . . . . . . . . . . . . . . . . 5
3. EAP-AKA' . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1. AT_KDF_INPUT . . . . . . . . . . . . . . . . . . . . . . 8
3.2. AT_KDF . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.3. Key Derivation . . . . . . . . . . . . . . . . . . . . . 13
3.4. Hash Functions . . . . . . . . . . . . . . . . . . . . . 15
3.4.1. PRF' . . . . . . . . . . . . . . . . . . . . . . . . 15
3.4.2. AT_MAC . . . . . . . . . . . . . . . . . . . . . . . 15
3.4.3. AT_CHECKCODE . . . . . . . . . . . . . . . . . . . . 15
3.5. Summary of Attributes for EAP-AKA' . . . . . . . . . . . 16
4. Bidding Down Prevention for EAP-AKA . . . . . . . . . . . . . 18
4.1. Summary of Attributes for EAP-AKA . . . . . . . . . . . . 20
5. Peer Identities . . . . . . . . . . . . . . . . . . . . . . . 20
5.1. Username Types in EAP-AKA' Identities . . . . . . . . . . 20
5.2. Generating Pseudonyms and Fast Re-Authentication
Identities . . . . . . . . . . . . . . . . . . . . . . . 21
5.3. Identifier Usage in 5G . . . . . . . . . . . . . . . . . 22
5.3.1. Key Derivation . . . . . . . . . . . . . . . . . . . 23
5.3.2. EAP Identity Response and EAP-AKA' AT_IDENTITY
Attribute . . . . . . . . . . . . . . . . . . . . . . 24
6. Exported Parameters . . . . . . . . . . . . . . . . . . . . . 24
7. Security Considerations . . . . . . . . . . . . . . . . . . . 25
7.1. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . 28
Arkko, et al. Expires May 3, 2021 [Page 2]
Internet-Draft EAP-AKA' October 2020
7.2. Discovered Vulnerabilities . . . . . . . . . . . . . . . 29
7.3. Pervasive Monitoring . . . . . . . . . . . . . . . . . . 32
7.4. Security Properties of Binding Network Names . . . . . . 32
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 34
8.1. Type Value . . . . . . . . . . . . . . . . . . . . . . . 34
8.2. Attribute Type Values . . . . . . . . . . . . . . . . . . 34
8.3. Key Derivation Function Namespace . . . . . . . . . . . . 34
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 34
9.1. Normative References . . . . . . . . . . . . . . . . . . 35
9.2. Informative References . . . . . . . . . . . . . . . . . 36
Appendix A. Changes from RFC 5448 . . . . . . . . . . . . . . . 40
Appendix B. Changes to RFC 4187 . . . . . . . . . . . . . . . . 40
Appendix C. Changes from Previous Version of This Draft . . . . 41
Appendix D. Importance of Explicit Negotiation . . . . . . . . . 44
Appendix E. Test Vectors . . . . . . . . . . . . . . . . . . . . 44
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 49
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 49
1. Introduction
The 3GPP Mobile Network Authentication and Key Agreement (AKA) is the
primary authentication mechanism for devices wishing to access mobile
networks. [RFC4187] (EAP-AKA) made the use of this mechanism
possible within the Extensible Authentication Protocol (EAP)
framework [RFC3748].
[RFC5448] (EAP-AKA') was an improved version of EAP-AKA. This memo
replaces the specification of EAP-AKA'. EAP-AKA' was defined in RFC
5448 and updated EAP-AKA RFC 4187. As such this document obsoletes
RFC 5448 and updates RFC 4187.
EAP-AKA' is commonly implemented in mobile phones and network
equipment. It can be used for authentication to gain network access
via Wireless LAN networks and, with 5G, also directly to mobile
networks.
EAP-AKA' differs from EAP-AKA by providing a different key derivation
function. This function binds the keys derived within the method to
the name of the access network. This limits the effects of
compromised access network nodes and keys. EAP-AKA' also updates the
algorithm used for hash functions.
The EAP-AKA' method employs the derived keys CK' and IK' from the
3GPP specification [TS-3GPP.33.402] and updates the used hash
function to SHA-256 [FIPS.180-4] and HMAC to HMAC-SHA-256.
Otherwise, EAP-AKA' is equivalent to EAP-AKA. Given that a different
EAP method type value is used for EAP-AKA and EAP-AKA', a mutually
Arkko, et al. Expires May 3, 2021 [Page 3]
Internet-Draft EAP-AKA' October 2020
supported method may be negotiated using the standard mechanisms in
EAP [RFC3748].
Note that any change of the key derivation must be unambiguous to
both sides in the protocol. That is, it must not be possible to
accidentally connect old equipment to new equipment and get the
key derivation wrong or attempt to use wrong keys without getting
a proper error message. See Appendix D for further information.
Note also that choices in authentication protocols should be
secure against bidding down attacks that attempt to force the
participants to use the least secure function. See Section 4 for
further information.
The changes from RFC 5448 to this specification are as follows:
o Update the reference on how the Network Name field is constructed
in the protocol. This update ensures that EAP-AKA' is compatible
with 5G deployments. RFC 5448 referred to the Release 8 version
of [TS-3GPP.24.302] and this update points to the first 5G
version, Release 15.
o Specify how EAP and EAP-AKA' use identifiers in 5G. Additional
identifiers are introduced in 5G, and for interoperability, it is
necessary that the right identifiers are used as inputs in the key
derivation. In addition, for identity privacy it is important
that when privacy-friendly identifiers in 5G are used, no
trackable, permanent identifiers are passed in EAP-AKA' either.
o Specify session identifiers and other exported parameters, as
those were not specified in [RFC5448] despite requirements set
forward in [RFC5247] to do so. Also, while [RFC5247] specified
session identifiers for EAP-AKA, it only did so for the full
authentication case, not for the case of fast re-authentication.
o Update the requirements on generating pseudonym usernames and fast
re-authentication identities to ensure identity privacy.
o Describe what has been learned about any vulnerabilities in AKA or
EAP-AKA'.
o Describe the privacy and pervasive monitoring considerations
related to EAP-AKA'.
Some of the updates are small. For instance, for the first update,
the reference update does not change the 3GPP specification number,
only the version. But this reference is crucial in correct
calculation of the keys resulting from running the EAP-AKA' method,
Arkko, et al. Expires May 3, 2021 [Page 4]
Internet-Draft EAP-AKA' October 2020
so an update of the RFC with the newest version pointer may be
warranted.
Note: Any further updates in 3GPP specifications that affect, for
instance, key derivation is something that EAP-AKA'
implementations need to take into account. Upon such updates
there will be a need to both update this specification and the
implementations.
It is an explicit non-goal of this draft to include any other
technical modifications, addition of new features or other changes.
The EAP-AKA' base protocol is stable and needs to stay that way. If
there are any extensions or variants, those need to be proposed as
standalone extensions or even as different authentication methods.
The rest of this specification is structured as follows. Section 3
defines the EAP-AKA' method. Section 4 adds support to EAP-AKA to
prevent bidding down attacks from EAP-AKA'. Section 5 specifies
requirements regarding the use of peer identities, including how EAP-
AKA' identifiers are used in 5G context. Section 6 specifies what
parameters EAP-AKA' exports out of the method. Section 7 explains
the security differences between EAP-AKA and EAP-AKA'. Section 8
describes the IANA considerations and Appendix A and Appendix B
explains what updates to RFC 5448 EAP-AKA' and RFC 4187 EAP-AKA have
been made in this specification. Appendix D explains some of the
design rationale for creating EAP-AKA'. Finally, Appendix E provides
test vectors.
Editor's Note: The publication of this RFC depends on its
normative references to 3GPP Technical Specifications reaching a
stable status for Release 15, as indicated by 3GPP. The RFC
Editor should check with the 3GPP liaisons that a stable version
from Release 15 is available and refer to that version. RFC
Editor: Please delete this note upon publication of this
specification as an RFC.
2. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
Arkko, et al. Expires May 3, 2021 [Page 5]
Internet-Draft EAP-AKA' October 2020
3. EAP-AKA'
EAP-AKA' is an EAP method that follows the EAP-AKA specification
[RFC4187] in all respects except the following:
o It uses the Type code 0x32, not 0x17 (which is used by EAP-AKA).
o It carries the AT_KDF_INPUT attribute, as defined in Section 3.1,
to ensure that both the peer and server know the name of the
access network.
o It supports key derivation function negotiation via the AT_KDF
attribute (Section 3.2) to allow for future extensions.
o It calculates keys as defined in Section 3.3, not as defined in
EAP-AKA.
o It employs SHA-256 / HMAC-SHA-256, not SHA-1 / HMAC-SHA-1
[FIPS.180-4] (Section 3.4 [RFC2104]).
Figure 1 shows an example of the authentication process. Each
message AKA'-Challenge and so on represents the corresponding message
from EAP-AKA, but with EAP-AKA' Type code. The definition of these
messages, along with the definition of attributes AT_RAND, AT_AUTN,
AT_MAC, and AT_RES can be found in [RFC4187].
Arkko, et al. Expires May 3, 2021 [Page 6]
Internet-Draft EAP-AKA' October 2020
Peer Server
| EAP-Request/Identity |
|<-------------------------------------------------------|
| |
| EAP-Response/Identity |
| (Includes user's Network Access Identifier, NAI) |
|------------------------------------------------------->|
| +--------------------------------------------------+
| | Server determines the network name and ensures |
| | that the given access network is authorized to |
| | use the claimed name. The server then runs the |
| | AKA' algorithms generating RAND and AUTN, and |
| | derives session keys from CK' and IK'. RAND and |
| | AUTN are sent as AT_RAND and AT_AUTN attributes, |
| | whereas the network name is transported in the |
| | AT_KDF_INPUT attribute. AT_KDF signals the used |
| | key derivation function. The session keys are |
| | used in creating the AT_MAC attribute. |
| +--------------------------------------------------+
| EAP-Request/AKA'-Challenge |
| (AT_RAND, AT_AUTN, AT_KDF, AT_KDF_INPUT, AT_MAC)|
|<-------------------------------------------------------|
+------------------------------------------------------+ |
| The peer determines what the network name should be, | |
| based on, e.g., what access technology it is using. | |
| The peer also retrieves the network name sent by | |
| the network from the AT_KDF_INPUT attribute. The | |
| two names are compared for discrepancies, and if | |
| necessary, the authentication is aborted. Otherwise,| |
| the network name from AT_KDF_INPUT attribute is | |
| used in running the AKA' algorithms, verifying AUTN | |
| from AT_AUTN and MAC from AT_MAC attributes. The | |
| peer then generates RES. The peer also derives | |
| session keys from CK'/IK'. The AT_RES and AT_MAC | |
| attributes are constructed. | |
+------------------------------------------------------+ |
| EAP-Response/AKA'-Challenge |
| (AT_RES, AT_MAC) |
|------------------------------------------------------->|
| +--------------------------------------------------+
| | Server checks the RES and MAC values received |
| | in AT_RES and AT_MAC, respectively. Success |
| | requires both to be found correct. |
| +--------------------------------------------------+
| EAP-Success |
|<-------------------------------------------------------|
Figure 1: EAP-AKA' Authentication Process
Arkko, et al. Expires May 3, 2021 [Page 7]
Internet-Draft EAP-AKA' October 2020
EAP-AKA' can operate on the same credentials as EAP-AKA and employ
the same identities. However, EAP-AKA' employs different leading
characters than EAP-AKA for the conventions given in Section 4.1.1 of
[RFC4187] for International Mobile Subscriber Identifier (IMSI) based
usernames. EAP-AKA' MUST use the leading character "6" (ASCII 36
hexadecimal) instead of "0" for IMSI-based permanent usernames, or
5G-specific identifiers in 5G networks. Identifier usage in 5G is
specified in Section 5.3. All other usage and processing of the
leading characters, usernames, and identities is as defined by EAP-
AKA [RFC4187]. For instance, the pseudonym and fast re-
authentication usernames need to be constructed so that the server
can recognize them. As an example, a pseudonym could begin with a
leading "7" character (ASCII 37 hexadecimal) and a fast re-
authentication username could begin with "8" (ASCII 38 hexadecimal).
Note that a server that implements only EAP-AKA may not recognize
these leading characters. According to Section 4.1.4 of [RFC4187],
such a server will re-request the identity via the EAP- Request/AKA-
Identity message, making obvious to the peer that EAP-AKA and
associated identity are expected.
3.1. AT_KDF_INPUT
The format of the AT_KDF_INPUT attribute is shown below.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| AT_KDF_INPUT | Length | Actual Network Name Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. Network Name .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are as follows:
AT_KDF_INPUT
This is set to 23.
Length
The length of the attribute, calculated as defined in [RFC4187],
Section 8.1.
Actual Network Name Length
Arkko, et al. Expires May 3, 2021 [Page 8]
Internet-Draft EAP-AKA' October 2020
This is a 2 byte actual length field, needed due to the
requirement that the previous field is expressed in multiples of 4
bytes per the usual EAP-AKA rules. The Actual Network Name Length
field provides the length of the network name in bytes.
Network Name
This field contains the network name of the access network for
which the authentication is being performed. The name does not
include any terminating null characters. Because the length of
the entire attribute must be a multiple of 4 bytes, the sender
pads the name with 1, 2, or 3 bytes of all zero bits when
necessary.
Only the server sends the AT_KDF_INPUT attribute. The value is sent
as specified in [TS-3GPP.24.302] for both non-3GPP access networks
for 5G access networks. Per [TS-3GPP.33.402], the server always
verifies the authorization of a given access network to use a
particular name before sending it to the peer over EAP-AKA'. The
value of the AT_KDF_INPUT attribute from the server MUST be non-
empty, with a greater than zero length in the Actual Network Name
Length field. If AT_KDF_INPUT attribute is empty, the peer behaves
as if AUTN had been incorrect and authentication fails. See
Section 3 and Figure 3 of [RFC4187] for an overview of how
authentication failures are handled.
In addition, the peer MAY check the received value against its own
understanding of the network name. Upon detecting a discrepancy, the
peer either warns the user and continues, or fails the authentication
process. More specifically, the peer SHOULD have a configurable
policy that it can follow under these circumstances. If the policy
indicates that it can continue, the peer SHOULD log a warning message
or display it to the user. If the peer chooses to proceed, it MUST
use the network name as received in the AT_KDF_INPUT attribute. If
the policy indicates that the authentication should fail, the peer
behaves as if AUTN had been incorrect and authentication fails.
The Network Name field contains a UTF-8 string. This string MUST be
constructed as specified in [TS-3GPP.24.302] for "Access Network
Identity". The string is structured as fields separated by colons
(:). The algorithms and mechanisms to construct the identity string
depend on the used access technology.
On the network side, the network name construction is a configuration
issue in an access network and an authorization check in the
authentication server. On the peer, the network name is constructed
based on the local observations. For instance, the peer knows which
access technology it is using on the link, it can see information in
Arkko, et al. Expires May 3, 2021 [Page 9]
Internet-Draft EAP-AKA' October 2020
a link-layer beacon, and so on. The construction rules specify how
this information maps to an access network name. Typically, the
network name consists of the name of the access technology, or the
name of the access technology followed by some operator identifier
that was advertised in a link-layer beacon. In all cases,
[TS-3GPP.24.302] is the normative specification for the construction
in both the network and peer side. If the peer policy allows running
EAP-AKA' over an access technology for which that specification does
not provide network name construction rules, the peer SHOULD rely
only on the information from the AT_KDF_INPUT attribute and not
perform a comparison.
If a comparison of the locally determined network name and the one
received over EAP-AKA' is performed on the peer, it MUST be done as
follows. First, each name is broken down to the fields separated by
colons. If one of the names has more colons and fields than the
other one, the additional fields are ignored. The remaining
sequences of fields are compared, and they match only if they are
equal character by character. This algorithm allows a prefix match
where the peer would be able to match "", "FOO", and "FOO:BAR"
against the value "FOO:BAR" received from the server. This
capability is important in order to allow possible updates to the
specifications that dictate how the network names are constructed.
For instance, if a peer knows that it is running on access technology
"FOO", it can use the string "FOO" even if the server uses an
additional, more accurate description, e.g., "FOO:BAR", that contains
more information.
The allocation procedures in [TS-3GPP.24.302] ensure that conflicts
potentially arising from using the same name in different types of
networks are avoided. The specification also has detailed rules
about how a client can determine these based on information available
to the client, such as the type of protocol used to attach to the
network, beacons sent out by the network, and so on. Information
that the client cannot directly observe (such as the type or version
of the home network) is not used by this algorithm.
The AT_KDF_INPUT attribute MUST be sent and processed as explained
above when AT_KDF attribute has the value 1. Future definitions of
new AT_KDF values MUST define how this attribute is sent and
processed.
3.2. AT_KDF
AT_KDF is an attribute that the server uses to reference a specific
key derivation function. It offers a negotiation capability that can
be useful for future evolution of the key derivation functions.
Arkko, et al. Expires May 3, 2021 [Page 10]
Internet-Draft EAP-AKA' October 2020
The format of the AT_KDF attribute is shown below.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| AT_KDF | Length | Key Derivation Function |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are as follows:
AT_KDF
This is set to 24.
Length
The length of the attribute, calculated as defined in [RFC4187],
Section 8.1. For AT_KDF, the Length field MUST be set to 1.
Key Derivation Function
An enumerated value representing the key derivation function that
the server (or peer) wishes to use. Value 1 represents the
default key derivation function for EAP-AKA', i.e., employing CK'
and IK' as defined in Section 3.3.
Servers MUST send one or more AT_KDF attributes in the EAP-Request/
AKA'-Challenge message. These attributes represent the desired
functions ordered by preference, the most preferred function being
the first attribute.
Upon receiving a set of these attributes, if the peer supports and is
willing to use the key derivation function indicated by the first
attribute, the function is taken into use without any further
negotiation. However, if the peer does not support this function or
is unwilling to use it, it does not process the received EAP-Request/
AKA'-Challenge in any way except by responding with the EAP-Response/
AKA'-Challenge message that contains only one attribute, AT_KDF with
the value set to the selected alternative. If there is no suitable
alternative, the peer behaves as if AUTN had been incorrect and
authentication fails (see Figure 3 of [RFC4187]). The peer fails the
authentication also if there are any duplicate values within the list
of AT_KDF attributes (except where the duplication is due to a
request to change the key derivation function; see below for further
information).
Arkko, et al. Expires May 3, 2021 [Page 11]
Internet-Draft EAP-AKA' October 2020
Upon receiving an EAP-Response/AKA'-Challenge with AT_KDF from the
peer, the server checks that the suggested AT_KDF value was one of
the alternatives in its offer. The first AT_KDF value in the message
from the server is not a valid alternative since the peer should have
accepted it without further negotiation. If the peer has replied
with the first AT_KDF value, the server behaves as if AT_MAC of the
response had been incorrect and fails the authentication. For an
overview of the failed authentication process in the server side, see
Section 3 and Figure 2 of [RFC4187]. Otherwise, the server re-sends
the EAP-Response/AKA'-Challenge message, but adds the selected
alternative to the beginning of the list of AT_KDF attributes and
retains the entire list following it. Note that this means that the
selected alternative appears twice in the set of AT_KDF values.
Responding to the peer's request to change the key derivation
function is the only legal situation where such duplication may
occur.
When the peer receives the new EAP-Request/AKA'-Challenge message, it
MUST check that the requested change, and only the requested change,
occurred in the list of AT_KDF attributes. If so, it continues with
processing the received EAP-Request/AKA'-Challenge as specified in
[RFC4187] and Section 3.1 of this document. If not, it behaves as if
AT_MAC had been incorrect and fails the authentication. If the peer
receives multiple EAP-Request/AKA'-Challenge messages with differing
AT_KDF attributes without having requested negotiation, the peer MUST
behave as if AT_MAC had been incorrect and fail the authentication.
Note that the peer may also request sequence number resynchronization
[RFC4187]. This happens after AT_KDF negotiation has already
completed. That is, the EAP-Request/AKA'-Challenge and, possibly,
the EAP-Response/AKA'-Challenge message are exchanged first to come
up with a mutually acceptable key derivation function, and only then
the possible AKA'-Synchronization-Failure message is sent. The AKA'-
Synchronization-Failure message is sent as a response to the newly
received EAP-Request/AKA'-Challenge which is the last message of the
AT_KDF negotiation. Note that if the first proposed KDF is
acceptable, then last message is at the same time the first EAP-
Request/AKA'-Challenge message. The AKA'-Synchronization-Failure
message MUST contain the AUTS parameter as specified in [RFC4187] and
a copy the AT_KDF attributes as they appeared in the last message of
the AT_KDF negotiation. If the AT_KDF attributes are found to differ
from their earlier values, the peer and server MUST behave as if
AT_MAC had been incorrect and fail the authentication.
Arkko, et al. Expires May 3, 2021 [Page 12]
Internet-Draft EAP-AKA' October 2020
3.3. Key Derivation
Both the peer and server MUST derive the keys as follows.
AT_KDF parameter has the value 1
In this case, MK is derived and used as follows:
MK = PRF'(IK'|CK',"EAP-AKA'"|Identity)
K_encr = MK[0..127]
K_aut = MK[128..383]
K_re = MK[384..639]
MSK = MK[640..1151]
EMSK = MK[1152..1663]
Here [n..m] denotes the substring from bit n to m, including bits
n and m. PRF' is a new pseudo-random function specified in
Section 3.4. The first 1664 bits from its output are used for
K_encr (encryption key, 128 bits), K_aut (authentication key, 256
bits), K_re (re-authentication key, 256 bits), MSK (Master Session
Key, 512 bits), and EMSK (Extended Master Session Key, 512 bits).
These keys are used by the subsequent EAP-AKA' process. K_encr is
used by the AT_ENCR_DATA attribute, and K_aut by the AT_MAC
attribute. K_re is used later in this section. MSK and EMSK are
outputs from a successful EAP method run [RFC3748].
IK' and CK' are derived as specified in [TS-3GPP.33.402]. The
functions that derive IK' and CK' take the following parameters:
CK and IK produced by the AKA algorithm, and value of the Network
Name field comes from the AT_KDF_INPUT attribute (without length
or padding).
The value "EAP-AKA'" is an eight-characters-long ASCII string. It
is used as is, without any trailing NUL characters.
Identity is the peer identity as specified in Section 7 of
[RFC4187].
When the server creates an AKA challenge and corresponding AUTN,
CK, CK', IK, and IK' values, it MUST set the Authentication
Management Field (AMF) separation bit to 1 in the AKA algorithm
[TS-3GPP.33.102]. Similarly, the peer MUST check that the AMF
separation bit is set to 1. If the bit is not set to 1, the peer
behaves as if the AUTN had been incorrect and fails the
authentication.
Arkko, et al. Expires May 3, 2021 [Page 13]
Internet-Draft EAP-AKA' October 2020
On fast re-authentication, the following keys are calculated:
MK = PRF'(K_re,"EAP-AKA' re-auth"|Identity|counter|NONCE_S)
MSK = MK[0..511]
EMSK = MK[512..1023]
MSK and EMSK are the resulting 512-bit keys, taking the first 1024
bits from the result of PRF'. Note that K_encr and K_aut are not
re-derived on fast re-authentication. K_re is the re-
authentication key from the preceding full authentication and
stays unchanged over any fast re-authentication(s) that may happen
based on it. The value "EAP-AKA' re-auth" is a sixteen-
characters-long ASCII string, again represented without any
trailing NUL characters. Identity is the fast re-authentication
identity, counter is the value from the AT_COUNTER attribute,
NONCE_S is the nonce value from the AT_NONCE_S attribute, all as
specified in Section 7 of [RFC4187]. To prevent the use of
compromised keys in other places, it is forbidden to change the
network name when going from the full to the fast re-
authentication process. The peer SHOULD NOT attempt fast re-
authentication when it knows that the network name in the current
access network is different from the one in the initial, full
authentication. Upon seeing a re-authentication request with a
changed network name, the server SHOULD behave as if the re-
authentication identifier had been unrecognized, and fall back to
full authentication. The server observes the change in the name
by comparing where the fast re-authentication and full
authentication EAP transactions were received at the
Authentication, Authorization, and Accounting (AAA) protocol
level.
AT_KDF has any other value
Future variations of key derivation functions may be defined, and
they will be represented by new values of AT_KDF. If the peer
does not recognize the value, it cannot calculate the keys and
behaves as explained in Section 3.2.
AT_KDF is missing
The peer behaves as if the AUTN had been incorrect and MUST fail
the authentication.
If the peer supports a given key derivation function but is unwilling
to perform it for policy reasons, it refuses to calculate the keys
and behaves as explained in Section 3.2.
Arkko, et al. Expires May 3, 2021 [Page 14]
Internet-Draft EAP-AKA' October 2020
3.4. Hash Functions
EAP-AKA' uses SHA-256 / HMAC-SHA-256, not SHA-1 / HMAC-SHA-1 (see
[FIPS.180-4] [RFC2104]) as in EAP-AKA. This requires a change to the
pseudo-random function (PRF) as well as the AT_MAC and AT_CHECKCODE
attributes.
3.4.1. PRF'
The PRF' construction is the same one IKEv2 uses (see Section 2.13 of
[RFC7296]). The function takes two arguments. K is a 256-bit value
and S is a byte string of arbitrary length. PRF' is defined as
follows:
PRF'(K,S) = T1 | T2 | T3 | T4 | ...
where:
T1 = HMAC-SHA-256 (K, S | 0x01)
T2 = HMAC-SHA-256 (K, T1 | S | 0x02)
T3 = HMAC-SHA-256 (K, T2 | S | 0x03)
T4 = HMAC-SHA-256 (K, T3 | S | 0x04)
...
PRF' produces as many bits of output as is needed. HMAC-SHA-256 is
the application of HMAC [RFC2104] to SHA-256.
3.4.2. AT_MAC
When used within EAP-AKA', the AT_MAC attribute is changed as
follows. The MAC algorithm is HMAC-SHA-256-128, a keyed hash value.
The HMAC-SHA-256-128 value is obtained from the 32-byte HMAC-SHA-256
value by truncating the output to the first 16 bytes. Hence, the
length of the MAC is 16 bytes.
Otherwise, the use of AT_MAC in EAP-AKA' follows Section 10.15 of
[RFC4187].
3.4.3. AT_CHECKCODE
When used within EAP-AKA', the AT_CHECKCODE attribute is changed as
follows. First, a 32-byte value is needed to accommodate a 256-bit
hash output:
Arkko, et al. Expires May 3, 2021 [Page 15]
Internet-Draft EAP-AKA' October 2020
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| AT_CHECKCODE | Length | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Checkcode (0 or 32 bytes) |
| |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Second, the checkcode is a hash value, calculated with SHA-256
[FIPS.180-4], over the data specified in Section 10.13 of [RFC4187].
3.5. Summary of Attributes for EAP-AKA'
Table 1 provides a guide to which attributes may be found in which
kinds of messages, and in what quantity.
Messages are denoted with numbers in parentheses as follows:
(1) EAP-Request/AKA-Identity,
(2) EAP-Response/AKA-Identity,
(3) EAP-Request/AKA-Challenge,
(4) EAP-Response/AKA-Challenge,
(5) EAP-Request/AKA-Notification,
(6) EAP-Response/AKA-Notification,
(7) EAP-Response/AKA-Client-Error
(8) EAP-Request/AKA-Reauthentication,
(9) EAP-Response/AKA-Reauthentication,
(10) EAP-Response/AKA-Authentication-Reject, and
(11) EAP-Response/AKA-Synchronization-Failure.
The column denoted with "E" indicates whether the attribute is a
nested attribute that MUST be included within AT_ENCR_DATA.
In addition:
Arkko, et al. Expires May 3, 2021 [Page 16]
Internet-Draft EAP-AKA' October 2020
"0" indicates that the attribute MUST NOT be included in the
message,
"1" indicates that the attribute MUST be included in the message,
"0-1" indicates that the attribute is sometimes included in the
message,
"0+" indicates that zero or more copies of the attribute MAY be
included in the message,
"1+" indicates that there MUST be at least one attribute in the
message but more than one MAY be included in the message, and
"0*" indicates that the attribute is not included in the message
in cases specified in this document, but MAY be included in the
future versions of the protocol.
The attribute table is shown below. The table is largely the same as
in the EAP-AKA attribute table ([RFC4187] Section 10.1), but changes
how many times AT_MAC may appear in EAP-Response/AKA'-Challenge
message as it does not appear there when AT_KDF has to be sent from
the peer to the server. The table also adds the AT_KDF and
AT_KDF_INPUT attributes.
Arkko, et al. Expires May 3, 2021 [Page 17]
Internet-Draft EAP-AKA' October 2020
Attribute (1) (2) (3) (4) (5) (6) (7) (8) (9) (10)(11) E
AT_PERMANENT_ID_REQ 0-1 0 0 0 0 0 0 0 0 0 0 N
AT_ANY_ID_REQ 0-1 0 0 0 0 0 0 0 0 0 0 N
AT_FULLAUTH_ID_REQ 0-1 0 0 0 0 0 0 0 0 0 0 N
AT_IDENTITY 0 0-1 0 0 0 0 0 0 0 0 0 N
AT_RAND 0 0 1 0 0 0 0 0 0 0 0 N
AT_AUTN 0 0 1 0 0 0 0 0 0 0 0 N
AT_RES 0 0 0 1 0 0 0 0 0 0 0 N
AT_AUTS 0 0 0 0 0 0 0 0 0 0 1 N
AT_NEXT_PSEUDONYM 0 0 0-1 0 0 0 0 0 0 0 0 Y
AT_NEXT_REAUTH_ID 0 0 0-1 0 0 0 0 0-1 0 0 0 Y
AT_IV 0 0 0-1 0* 0-1 0-1 0 1 1 0 0 N
AT_ENCR_DATA 0 0 0-1 0* 0-1 0-1 0 1 1 0 0 N
AT_PADDING 0 0 0-1 0* 0-1 0-1 0 0-1 0-1 0 0 Y
AT_CHECKCODE 0 0 0-1 0-1 0 0 0 0-1 0-1 0 0 N
AT_RESULT_IND 0 0 0-1 0-1 0 0 0 0-1 0-1 0 0 N
AT_MAC 0 0 1 0-1 0-1 0-1 0 1 1 0 0 N
AT_COUNTER 0 0 0 0 0-1 0-1 0 1 1 0 0 Y
AT_COUNTER_TOO_SMALL 0 0 0 0 0 0 0 0 0-1 0 0 Y
AT_NONCE_S 0 0 0 0 0 0 0 1 0 0 0 Y
AT_NOTIFICATION 0 0 0 0 1 0 0 0 0 0 0 N
AT_CLIENT_ERROR_CODE 0 0 0 0 0 0 1 0 0 0 0 N
AT_KDF 0 0 1+ 0+ 0 0 0 0 0 0 1+ N
AT_KDF_INPUT 0 0 1 0 0 0 0 0 0 0 0 N
Table 1: The attribute table
4. Bidding Down Prevention for EAP-AKA
As discussed in [RFC3748], negotiation of methods within EAP is
insecure. That is, a man-in-the-middle attacker may force the
endpoints to use a method that is not the strongest that they both
support. This is a problem, as we expect EAP-AKA and EAP-AKA' to be
negotiated via EAP.
In order to prevent such attacks, this RFC specifies a new mechanism
for EAP-AKA that allows the endpoints to securely discover the
capabilities of each other. This mechanism comes in the form of the
AT_BIDDING attribute. This allows both endpoints to communicate
their desire and support for EAP-AKA' when exchanging EAP-AKA
messages. This attribute is not included in EAP-AKA' messages. It
is only included in EAP-AKA messages. (Those messages are protected
with the AT_MAC attribute.) This approach is based on the assumption