Re: [Cfrg] TLS PRF security proof?

[Paul Hoffman <[e-mail]>]

On Jul 9, 2014, at 8:18 AM, Andy Lutomirski <[e-mail]> wrote:

> I can't speak for the TLS WG, but from my own perspective, I have
> three problems with HDKF:
> 
> 1. HKDF is parametrized by a hash.  What hash should people use?

Any one that has no known weakening of preimage resistance. That is: nearly any of them.

> (Hence my suggestion of using combiners -- changing the PRF in an
> existing protocol is a real PITA and might not even be possible
> without introducing security holes.)

Adding more choices makes interoperability less likely. In real-world protocols, excellent interoperability with almost-perfect security is *much* better than good interoperability with perfect security.

> 2. The RFC didn't make the security properties clear to me.  For
> example, protocols should stick nonces into the salt.  Oh, wait, they
> shouldn't stick nonces into the salt without care.  

Can you justify that second sentence with anything from RFC 5869? In fact, it says the opposite:

   Ideally, the salt value is a random (or pseudorandom) string of the
   length HashLen.  Yet, even a salt value of less quality (shorter in
   size or with limited entropy) may still make a significant
   contribution to the security of the output keying material; designers
   of applications are therefore encouraged to provide salt values to
   HKDF if such values can be obtained by the application.

> Can I use multiple
> "info" values to safely extract key material and publish it?

Yes. Can you point at something in the RFC that indicates any different?

> 3. (Only relevant to hashes using MD construction) My understanding of
> HMAC is that it's secure against generic attacks on MD hashes if the
> key is secret and unpredictable.  HKDF doesn't necessarily use a
> secret, unpredictable key for HMAC.  Is HKDF-SHA-1 insecure as a
> result?  What about HKDF-SHA-512 against an adversary with unlimited
> precomputation power?

For the discussion at hand, the key is secret and unpredictable.

--Paul Hoffman