Re: [Cfrg] Help with the use of contexts

[Yaron Sheffer <[e-mail]>]

> Domain separation for signed values is important and TLS already defines
> context strings for signature operations:
> https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.4.2
>
> The way that this is constructed (due to me) is generic for any signature
> scheme. (Basically just have the context string be NUL-terminated at the
> beginning of the signed message.)
>
> So for TLS I believe that the issue is already taken care of. It would also
> probably just add pain for implementers if the context string were to be
> duplicated as an input to the signature scheme where signature schemes
> support it.
>
>
> Cheers
>
> AGL

Hi Adam,

Wide industry adoption of TLS 1.2 took around 10 years. So IMO saying 
"this is solved in TLS 1.3" is not a good enough answer, if in the 
meantime we will continue to see cross-protocol and cross-TLS-version 
attacks.

Please note that the original post refers to "TLS 1.2 (and earlier)."

Thanks,
	Yaron