Re: [Cfrg] Review of draft-selander-ace-cose-ecdhe-12

Russ Housley <housley@vigilsec.com> Fri, 01 March 2019 21:07 UTC

From: Russ Housley <housley@vigilsec.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_F6A78646-8FCA-4656-8D8A-69F296F8B591"
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Date: Fri, 01 Mar 2019 16:07:51 -0500
References: <CAMr0u6=V+wwaGA=08a5=XTerXJ6k=etzPbpMAf6YME8ERynEog@mail.gmail.com>
To: IRTF CFRG <cfrg@irtf.org>
In-Reply-To: <CAMr0u6=V+wwaGA=08a5=XTerXJ6k=etzPbpMAf6YME8ERynEog@mail.gmail.com>
Message-Id: <DD54B003-56D5-4483-81E8-14EBA78600B9@vigilsec.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/PLlE0fls43kxr_yN_IqtjYfYlk8>
Subject: Re: [Cfrg] Review of draft-selander-ace-cose-ecdhe-12
Precedence: list

> On Mar 1, 2019, at 3:29 PM, Stanislav V. Smyshlyaev <smyshsv@gmail.com> wrote:
> 
> Minor concerns:
> 
> This doesn't seem to be crucial for the security, but I believe that it would be helpful to provide a comment in Section 3.3 about the reasons why PSK is used as a 'salt', not as a "secret" in HKDF.

I did not comment on it in my review, but I did not this when I read the document.  I actually thought it was kind of clever.

That said, RFC 5869 defines the salt as:

      salt     optional salt value (a non-secret random value);
               if not provided, it is set to a string of HashLen zeros.

So, while I have no concerns about the security of the construction, I do think the Security Considerations need to say that the PSK needs to be kept secret even though it is being input into the KDF as salt.

Russ

[Cfrg] Review of draft-selander-ace-cose-ecdhe-12 Stanislav V. Smyshlyaev
Re: [Cfrg] Review of draft-selander-ace-cose-ecdh… Russ Housley
Re: [Cfrg] Review of draft-selander-ace-cose-ecdh… John Mattsson
Re: [Cfrg] Review of draft-selander-ace-cose-ecdh… Stanislav V. Smyshlyaev