Till Studer's Notes

Recent Notes

3 min read

MACsec

IEEE 802.1AE (also known as MACsec) is a network security standard that operates at the medium access control layer and defines connectionless data confidentiality and integrity for media access independent protocols. It is standardized by the IEEE 802.1 working group.

Why MACsec?

  • Vampire Tap
  • Fiber Optic Tap

Four Stations Attached to a LAN

PAE = Port Access Entity

Connectivity Association (CA)

Secure Channel (SC) and Secure Association (SA)

Each Secure Channel (SC) comprises a succession of Secure Associations (SAs) each with a different SAK (SA Key).

Secure Channel and Secure Association Identifiers

The Association Number (2 bits) allows the overlapping rekeying of the Secure Association during which two different SAKs co-exist.

Example

Two Stations in a Point-to-point LAN

Connectivity Association (CA)

Secure Channel (SC) and Secure Association (SA)

MACsec Frame Format

SecTag (Security Tag)

TCI (TAG Control Information Bits)

MACsec Key Agreement (MKA)

Key Derivation Function (KDF)

  • KDF allow to generate keys for a context given a master key
    • Normally a pseudo-random-function (PRF)
      • HMAC or CMAC (cipher-based MAC)
    • KDF is deterministic
      • Output fixed for given inputs
  • The MKA KDF is a PRF based on AES-CMAC with a 128 or 256 bit key.
    • Output ← KDF(key=..., label=..., context=..., length=...)

Connectivity Association Key (CAK)

  • CAK as a Pre-Shared-Key (PSK)
    • Can be used either as a pairwise CAK or group CAK
    • Statically configured PSK
    • CKN can be chosen arbitrarily with a size of 1..32 octets
  • CAK via EAP
    • Can be used as a pairwise CAK.
    • Dynamically derived CAK and CKN between two PAEs via EAP
      • CAK ← KDF(key=MSK[0..15]/MSK[0..31], label="IEEE8021 EAP CAK", context=mac1 | mac2, length=128/256)
      • CKN ← KDF(key=MSK[0..15]/MSK[0..31], label="IEEE8021 EAP CKN", context=EAP Session-ID | mac1 | mac2, length=128/256)
        • CKN = (public) CA Key Name
      • Where mac1 < mac2 and are the MAC addresses of the PAEs and the Master Session Key (MSK) and Session-ID of the EAP method (EAP-TLS, EAP-PEAP, etc) is included.

Secure Association Key (SAK)

  1. Members of CA have shared CAK
  2. Key Server (KS) generates SAK
    • From CAK via KDF or using fresh randomness
  3. KS distributes SAK to other members of CA
    • Using MKPDU over EAPOL
    • Via “ad-hoc” secure channel
    • Requires keys for integrity (ICK) and encryption (KEK)
    • Generated from CAK via KDF
      • ⇒ Any CA member can decrypt and verify

MKA Distributes Random SAK Using CAK

MKA Key Derivation Function for CAK

  • KEK ← KDF(key=CAK, label="IEEE8021 KEK", context=CKN[0..15], length=128/256)
  • ICK ← KDF(key=CAK, label="IEEE8021 ICK", context=CKN[0..15], length=128/256)
  • SAK ← KDF(key=CAK, label="IEEE8021 SAK", context=KS-nonce | MI-value list | KN, length=128/256)
  • KS (Key Server)
    • either elected or EAP Authenticator
  • MI (Member Identifier)
    • all members of a CA
  • KN (Key Number)
    • assigned by Key Server

Use of Pairwise CAKs to Distribute a Group CAK

Relevant Note(s):

Graph View

Backlinks