Re: [Cfrg] TLS PRF security proof?

Definitely useful in the long run, but in the short run no one is
going to modify more than a small fraction of the existing TLS
deployments.  Perhaps in TLS 1.3.

Any chance of cooking up a security proof for the existing PRF? I'm
not optimistic since HMAC_k is a coalescent function => the HMAC_k^t(m) 
eventually starts to cycle. Typically the time to fall onto the cycle
and the length of the cycle are both about sqrt(N), but the usual random
map model gives a quantifiable probability of falling onto a far shorter
is a far shorter time.  A low enough probability to be of little practical
concern, but still a possible source of problems.

> -----Original Message-----
> From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Andy Lutomirski
> Sent: Tuesday, July 08, 2014 3:24 PM
> To: Dan Brown
> Cc: cfrg@irtf.org
> Subject: Re: [Cfrg] TLS PRF security proof?
> 
> On Tue, Jul 8, 2014 at 12:19 PM, Dan Brown <dbrown@certicom.com> wrote:
> >
> > Dear CFRG list,
> >
> >
> >
> > Is there a published security proof for the current TLS PRF in the
> draft TLS 1.3?
> >
> 
> Would it be useful if CFRG were to publish a recommended PRF?  Perhaps
> something using a modern hash function combiner using (HMAC-)SHA-512
> and either SHA-3 or something from the Salsa/ChaCha family as the base?
> 
> --Andy
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg