IdP provides the RP with the MSK: The IdP sends a success result EAP to the RP, along with an optional set of AAA attributes associated with the client (usually as one or more SAML Assertions). In addition, the EAP MSK is returned to the RP.