I am trying to wrap my head around MACSec Key agreement protocol (MKA) and its relation with MACSec and other protocols. So bear with me.

To my understanding in order to MACSec to work, all nodes must have a shared encryption key called secure association key (SAK). Where Key server is responsible for generating and distributing. And in order to distribute securely it uses Key encryption key (KEK). Which is generated from CAK using key derivation function (KDF) having Connectivity association key (CAK) as input.

According to IEEE 802.1X

A pairwise CAK is derived directly from the EAP MSK using the following transform:

CAK = KDF(Key, Label, mac1 | mac2, CAKlength)


Key = MSK[0-15] for a 128 bit CAK, MSK[0-31] for a 256 bit CAK

Label = "IEEE8021 EAP CAK"

mac1 = the lesser of the two source MAC addresses used in the EAPOL-EAP exchange (11.1.2)

mac2 = the greater of the two source MAC addresses used in the EAPOL-EAP exchange

CAKlength = two octets representing an integer value (128 for a 128 bit CAK, 256 for a 256 bit CAK) with the most significant octet first.

MSK is supposed to be what's called EAP (Extensible Authentication Protocol ) Master Session Key. I've been reading in IEEE RFC3748 for EAP, but I can't grasp how this MSK is generated and how it's securely distributed ?

Also is there anyway to generate CAK other than EAP authentication process and pre-shared keys ?


  • I found this whitepaper very informative. ijerd.com/paper/vol3-issue10/D03102934.pdf Personally, I've never seen an implementation of MACSec that didn't use either PSK or EAPOL, but I'll be watching the answers :)
    – Goodies
    Commented Jul 30, 2018 at 17:41

1 Answer 1


For your first question I'd say it depends on the EAP flavor. For example this link explains how EAP-TLS derives MSK by truncating 64 bytes from the secret securely agreed upon following the TLS handshake.

At this point the supplicant and the authentication server would both have the MSK. Then the authentication server transports the MSK to the authenticator RFC:

After successful authentication, the EAP server transports the MSK to the authenticator. Note that this is performed using AAA protocols, not EAP itself.

IETF defined some standard RADIUS attributes to be used for transporting the MSK, as highlighted by the first link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.