ISO/IEC/IEEE 8802-21:2018/Cor 1:2018 情報技術—システム間の電気通信と情報交換—ローカルおよびメトロポリタンエリアネットワーク—特定の要件—パート21：メディアに依存しないサービスフレームワーク—技術的基準1：グループセッションの鍵導出におけるパラメータ定義の明確化 | ページ 14

この概要は、IEEE Std 802.21-2017/Cor 1-2017, ローカルおよびメトロポリタン エリア ネットワークの IEEE 標準 — Part 21: メディア独立サービス フレームワーク — 正誤表 1: グループ セッション キー導出におけるパラメーター定義の明確化の一部ではありません。

Introduction

This corrigendum provides technical clarifications and editorial corrections to the parameter definition in group session key derivation published in IEEE Std 802.21-2017.

The editing instructions are shown in bold italic . Four editing instructions are used: change, delete, insert, and replace. Change is used to make corrections in existing text or tables. The editing instruction specifies the location of the change and describes what is being changed by using strikethrough (to remove old material) and underscore (to add new material). Delete removes existing material. Insert adds new material without disturbing the existing material. Insertions may require renumbering. If so, renumbering instructions are given in the editing instruction. Replace is used to make changes in figures or equations by removing the existing figure or equation and replacing it with a new one. Editing instructions, change markings, and this NOTE will not be carried over into future editions because the changes will be incorporated into the base standard.

9. MIS protocol protection

9.6 Group addressed message protection

Change 9.6.1 as follows:

9.6.1 Group session key derivation

When a recipient of a GKB successfully decrypts an MGK from the GKB, a media independent group session key (MIGSK) is derived from the MGK to protect group manipulation commands and group addressed commands:

For the key derivation, the following notations and parameters are used:

• K: key derivation key. It is truncated from a master group key (MGK). The length of K is determined by the pseudorandom function (PRF) used for key derivation. If HMAC-SHA-1 or HMAC-SHA-256 is used as a PRF, then the full MGK is used as key derivation key, K. If CMAC-AES is used as a PRF, then the first 128 bits of MGK are used as derivation key, K.
• L: The binary length of derived keying material MIGSK and MIGKVK. L = L1 + L2; where L1 is determined by selected group ciphersuite (described in 9.6.5) and L2 is determined by group key distribution ciphersuites (described in 9.6.6).
• h: The output binary length of PRF used in the key derivation. That is, h is the length of the block of the keying material derived by one PRF execution. Specifically, for HMAC-SHA-1, h = 160 bits; for HMAC-SHA-256, h = 256 bits; for CMAC-AES, h = 128 bits.
• n: The number of iterations of PRF in order to generate L-bits keying material.
• c: The group ciphersuite code is a one octet string specified for each ciphersuite. The code is defined in 9.6.5.
• v: The length of the binary representation of the counter and the length of keying material L. The default value for v is 32.
• “MIGSK”: 0x4D4947534B, ASCII code in hex for string “MIGSK.”
• [a]₂: Binary representation of integer a with a given length.

For given PRF, the key derivation for MIGSK and MIGKVK can be described in the following procedures:

Fixed input values : h and v.

Input : K, L, and group ciphersuite code.

Process :

• a)
• b) If n > 2 ^v − 1, then indicate an error and stop.
• c) Result(0):= empty string.
• d) For i = 1 to n, do
  • 1)K(i):= PRF(K, “MIGSK” || [i]₂ || c || [L]₂).
  • 2) Result(i) = Result(i − 1) || K(i).

• e) Return Result(n). and MIGSK is the leftmost L bits of Result(n) and its length is represented as L1. MIGKVK is the remaining leftmost bits of Result(n) and its length is represented as L2. If L2 is ‘0’, MIGKVK is not included.