[TLS]Re: I-D Action: draft-ietf-tls-hybrid-design-10.txt

[Peter C <[e-mail]>]

Douglas,

> > It's not exactly due to the point formats, at least for X25519.  The RFC 7748
> > security considerations highlight that "for each public key, there are several
> > publicly computable public keys that are equivalent to it, i.e., they produce
> > the same shared secrets".  Assuming the early secret doesn't change, this
> > means equivalent public keys will produce the same handshake secrets and
> > the same master secrets.  The transcript hash does give you different
> > handshake traffic secrets and application traffic secrets, but I think that's too
> > late in the key schedule for [DOWLING].

> The proof in [DOWLING] only aims to prove that the handshake traffic secrets
> and application traffic secrets are secure, not that the handshake secrets and
> master secrets are secure, so for that purpose it should be okay that the
> transcript hash is incorporated a little later in the key schedule.

Sorry, I only meant that in Theorem 5.2 the dual-snPRF-ODH assumption is used
in Game B.2 to replace the handshake secret with a uniformly random value which
then allows the handshake traffic secrets to be replaced with uniformly random
values in Game B.3 using the PRF assumption on HKDF.Expand and the fact that
the labels are distinct.  Equivalent public keys mean that the handshake secret
is not indistinguishable from random and the proof fails at Game B.2.  The distinct
labels in Game B.3 only imply that the handshake traffic secrets will be different,
not that they are indistinguishable.

Peter