[Cfrg] question on secure key distribution

  Hi,

  I have a question on a technique to distrubute a secret key. This
technique is being proposed in an 802.11 task group (task group r)
to have a centralized key holder distribute keys to wireless access
points.

  Assuming Alice, and a set of {Bob, Bill, Brian}, and Trent.
Alice shares some secret with Trent, Kat, and wants Trent to distribute
keys to Bob, Bill, and Brian. Further, Trent has a "secure session"
with each of {Bob, Bill, and Brian}-- the B's-- such that their identities
have been authenticated and communication between Trent and each of
the B's have the properties of confidentiality, data integrity
protection, and data source authentication. Also there is a key
confirmation handshake HS(Alice, B) that will indicate whether Alice
and B (one of the B's) share a key.

  Is it adequate for Trent to use Kat as a master key to derive
specific keys to each of {Bob, Bill, Brian} using some pseudo-random
function that takes a key, k, and a message, m-- prf(k, m)-- namely,

  key for Bob: Kbob = prf(Kat, "Bob"...)
  key for Bill: Kbill = prf(Kat, "Bill"...)
  key for Brian: Kbrian = prf(Kat, "Brian"...)

and have each of those delivered over the "secure session" by Trent
to the appropriate recipient? Alice derives the keys herself and then
uses HS(Alice, B) to confirm that B has the right key.

  The idea being promoted is that Trent is giving a key that is based
on a particular identity to an entity that has proven it is that
identity. Furthermore, Trent would not give Bill's key to Bob or Brian.
If Alice is able to successfully perform HS(Alice, B) with one of the
B's then she can assume that B is a trusted and authorized entity since
it got the correct key from Trent (whom she trusts). Is this adequate?
Is there a flaw here anywhere?

  thanks,

  Dan.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg