[Lurk] lurk tls12 extension update & thoughts

[Daniel Migault <[e-mail]>]

Hi,

The working version is available on github:
https://github.com/mglt/draft-mglt-lurk-tls12/blob/master/draft-mglt-lurk-tls12.txt

Please find below my thoughts as well as how the working version has been
updated. Feed backs or comments are appreciated  ;-)

Yours,
Daniel

a) tls version

I believe this parameter is not necessary anymore. Although the current
document designates the extension as "tls12" it also generating masters for
TLS 1.1 and TLS 1.2. I suggest we focus the extension on TLS1.2 only to
remain coherent with the designation. This makes the the tls_version
parameter useless and I suggest we remove the parameter.

This has also been suggested by Ioana in her review.

b) other prf hash function than sha256 for TLS 1.2 ?

As the hash function "intrinsic" or "sha256" is determined by the
authentication method, I am inclined remove these values and only specify
the hash function used for the pfs. If things change in the future other
value for hash suites may be added.

prf provides hash function agility and currently explicitly specify the
hash function of the prf as well as the hash function of the pfs. On the
other hand, the hash associated to the prf seems to be SHA256 with TLS1.2.
That is RSA uses SHA256 to generate the master secret and eventually
extended master secret uses SHA256 to derive the session hash. ECDHE does
not specify the hash function as it is provided in the sig_and_hash
structure. As a result, the hash agility is limited to the hash function of
the pfs and hash function determined by authentication method.

c) perfect forward secrecy

The cost of implementing perfect forward secrecy is a hash computation on
the edge server and on key server. This makes a maximum of two additional
hash computations and I believe we should remove the "null" value.

To make a long story short b) and c) propose to change:

OLD:

PRFAlgorithm = Enum( BytesInteger(1),
    sha256_null = 0,
    sha256_sha256 = 1,
    intrinsic_null = 2,
    intrinsic_sha256 = 2,
)


NEW:

PFSAlgorithm = Enum( BytesInteger(1),
    sha256 = 0,
)

and dupdate the draft accordingly.



d) Extended premaster does not implement perfect forward secrecy, nor anti
replay. The main reason is that the opaque hash is transmitted, rather than
the full handshake. I believe we should address this by providing the key
server the necessary parameters to generate the session_hash. This needs to
change the design for the extended master.

e) Capabilities exchange has been updated