lowed. The IP connectiv- ity is established by means of the DHCP (Dynamic Host Configuration Protocol). The configuration file is downloaded by means of TFTP (Trivial File Transfer Protocol) that contains provisioned information and operational parameters. With the initial connection setup the BS passes Service Flow Encodings to the SS in multiple DSA-REQ (Dynamic Service Addition Request). The SS replies with DSA-RSP messages. The Service Flow Encodings contain either: Full definition of service attribute, omitting defaultable items if desired. Service class name. This is an ASCII string which is known at the BS and which indirectly specifies a set of QoS parameters. Privacy and encryption secures over-the-air transmissions. It involves authentication using X.509 certificates with RSA PKCS. The strong authentication of an SS prevents theft of service. It also prevents cloning. The data encryption used is currently the 56-bit DES in CBC mode. The IV is based on the frame number and is easily exportable. Message authentication uses key MACX management messages authenticated with one-way hash- ing (HMAC with SHA-1). It is designed to allow new/multiple encryption algorithms. The protocol descends from BPI+ (from DOCSIS). The security associations consist of a set of privacy information shared by a BS and one or more of its client SSs share in order to support secured communications. It includes traf- fic encryption keys and CBC IVs (Cyber Block Chaining). Primary Security Association (SA) is established during initial registration. Other SAs may be provisioned or dynami- cally created within the BS. A listing of key management messages is given in Table 13.2. Subscriber station authorization involves authentication and then authorization. The SS manufacturer's X.509 certificate binding the SS's public key to its other identifying information. A trust relation is assumed between equipment manufacturer and network Table 13.2 Key Management Messages PKM Message Description Authentication Information Contains the manuf