KEY(n) -> KEYMAT in Security Associations (06-369r4)

[Black_David at emc.com]

* From the T10 Reflector (t10 at t10.org), posted by:
* Black_David at emc.com
*
The original work that lead to the KEY(n) element in security
associations was based on a design assumption that all keys and
the hash output size would be the same, namely 256 bits.  Based
on comments in the CAP meeting, that's now clearly an overly
restrictive design assumption, so the array of keys [KEY(n)
element] in a security association should be changed to a
keying material bitstring [KEYMAT].  The consumer/user of the
keying material would specify how much is needed, and the KDF
produces the result (rounded up according to what the KDF can
do).  This is the approach used in IKEv2 (RFC 4306, Section
2.17) and is consistent with the NIST KDF that is specified in
06-369r4.  This change should be made.
Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953	      FAX: +1 (508) 293-7786
black_david at emc.com	   Mobile: +1 (978) 394-7754
----------------------------------------------------
*
* For T10 Reflector information, send a message with
* 'info t10' (no quotes) in the message body to majordomo at t10.org