Re: [TLS] Computation of static secret in anonymous DH

[Ilari Liusvaara <[e-mail]>]

On Wed, Jun 17, 2015 at 07:33:31AM +0000, Douglas Stebila wrote:
> In the DH-based draft of TLS 1.3 (https://github.com/ekr/tls13-spec/blob/ietf92_materials/draft-ietf-tls-tls13-dh-based.txt),
> how is the ServerParameters message containing the static secret SS
> constructed in the unauthenticated setting?

There's much newer version in ekr/tls13-spec#WIP_draft_06
(seems to have fixed most of the mistakes in the original WIP)

There for anonymous setting, seemingly SS is copy of ES, and
configurations (essentially replacement of ServerParameters) can't
appear at all (because one needs a certificate to send one).

I can't figure out what to use as configurations hash part of
session hash in case there isn't assumed or negotiated
configuration (some session hashes are seemingly always that
way, especially things like the one used for handshake key
derivation).

It also does not say what master key to use for handshake
encryption key derivation. I presume tmp2.

Also, I note that seemingly if configuration private key
gets compromised, one can MITM all sessions using it at
will (it has finite lifetime, but other than that, I see
no good way to revoke).


-Ilari