[TLS] The TLS PRF

People will recall that the current TLS PRF uses HMAC_MD5 and HMAC_SHA1
in tandem. In [BR05], Steve and I recommended that this be amended to
solely use HMAC_X where X is the hash algorithm defined as the hash
function negotiated for the cipher suite. This has three major
difficulties:

1. The TLS PRF is different from the one specified in NIST SP 800-56
   S 5.8.1. The TLS PRF is approved only for parameter sets 
   FA and EA, which themselves are only approved up to 2010.

2. The TLS PRF depends on a hash function and so can't be used
   with MAC algorithms that are not hash-based. So, for instance,
   you couldn't use CCM or GCM mode. (Note that this is an issue
   with the 800-56 KDF as well).

3. You can't use it with algorithm suites that define their own
   KDF, such as GOST and potentially Suite B.

In some sense these are separable problems.  I think clearly we need to
specify a standard TLS KDF (and note that we also use the PRF in
Finished), so that at least that KDF can be usable by all of the
ciphersuites we currently have.  And the recommendation to use
the ciphersuite-negotiated hash function still seems sound.
So, that leaves us with three questions:

1. Should the Hash-based PRF be based on the current PRF or NIST
   800-56? 

2. Should we define a standard non-Hash-based PRF? Where would
   we get it from? If not, what PRF should be used with GCM/CCM/etc.?

3. Should we allow the negotiation of ciphersuite-specific PRFs?

Can we get some discussion this issue please?

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls