[Seat] Re: Comments on draft-fossati-seat-early-attestation-03

[tirumal reddy <[e-mail]>]

Hi Usama,

Thanks for the feedback.

In the draft, the c_attest_base and s_attest_base are derived using
Derive-Secret (which internally calls HKDF-Expand-Label) with the input
keying material set to zero rather than branching off the Handshake Secret
or Master Secret, keeping the attest_base cryptographically independent of
the TLS traffic secrets. The transcript inputs
(ClientHello...Server-Finished for the client and
ClientHello...EncryptedExtensions for the server) binds the attest_base to
the specific TLS connection.

I don't think introducing new label strings for HKDF-Expand-Label is a key
schedule modification, an example would be the exporter_secret designed
specifically to allow applications to derive their own keying material,
TLS-Exporter internally uses HKDF-Expand-Label.

Cheers,
-Tiru

On Tue, 17 Mar 2026 at 08:58, Muhammad Usama Sardar <
[e-mail]> wrote:

> Hi Nathanael,
> On 17.03.26 04:15, Nathanael Ritz wrote:
>
> > Sure, Sec. 5.1.1 is actually not too big, but more specifically I meant
> the key schedule changes [0].
> Hrm. Unfortunately, even after I did a search for "key schedule changes",
> I found nothing. If I narrow the search to just "key schedule", then my
> browser helpfully jumps me to this clarifying statement in the appendix,
> which I'll quote directly, "Define the attestation binder and decouple it
> from the TLS key schedule." [2]. That certainly makes the intent clear to
> me.
>
> ah, I actually meant you could just click reference [0] and not search for
> the term "key schedule changes". We had this discussion about key schedule
> at the chartering time.
>
> Simply put, I am referring to the following 4 key schedule modifications
> in Sec. 5.1.1:
>
> c_attest_base = Derive-Secret(0, "c attestation base",
>                               ClientHello...Server-Finished)
> s_attest_base = Derive-Secret(0, "s attestation base",
>                               ClientHello...EncryptedExtensions)
>
> c_attest_binder = HKDF-Expand-Label(c_attest_base, "attestation",
>                                     TLS_Client_Public_Key, Hash.length)
> s_attest_binder = HKDF-Expand-Label(s_attest_base, "attestation",
>                                     TLS_Server_Public_Key, Hash.length)
>
> > These keys are not part of the standard RFC8446bis.
> What keys?
>
> The 4 quoted above.
>
> [0]
>>
>> https://www.ietf.org/archive/id/draft-fossati-seat-early-attestation-03.html#section-5.1.1-2
>>
> Best regards,
>
> -Usama
> _______________________________________________
> Seat mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>