Re: [TLS] Adding an additional step to exporters

Ilari Liusvaara <ilariliusvaara@welho.com> Fri, 24 February 2017 17:42 UTC

Date: Fri, 24 Feb 2017 19:42:15 +0200
From: Ilari Liusvaara <ilariliusvaara@welho.com>
To: Hugo Krawczyk <hugo@ee.technion.ac.il>
Message-ID: <20170224174215.GA13873@LK-Perkele-V2.elisa-laajakaista.fi>
References: <CABkgnnVo0gU=jaR-qV4hypmsjVW6Vdu1RizVD0OPh0ry6vzKfQ@mail.gmail.com> <04431852-c05f-7db8-faf1-7aa622c01b75@cs.tu-darmstadt.de> <CABkgnnU2fXmh=MRANU341n+G16t=Dnt8vQeCSHV4=J=89nWBhQ@mail.gmail.com> <CADi0yUM4NQkj_y49Gxg6D_1CXq7sNVReaAS3XWv5C9yoqQdT2A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <CADi0yUM4NQkj_y49Gxg6D_1CXq7sNVReaAS3XWv5C9yoqQdT2A@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: ilariliusvaara@welho.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/20zSSHuuwWPp-ar0sYyEz3leyYU>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Adding an additional step to exporters
Precedence: list

On Fri, Feb 24, 2017 at 11:47:32AM -0500, Hugo Krawczyk wrote:
> Martin,
> 
> Which of these two derivation schemes are you proposing?
> Are you assuming that all uses of the exporter_secret are known at the end
> of
> the handshake? If not, you still need to keep an exporter_secret beyond the
> handshake.
> 
> Master Secret
>       |
>       |
>       +-----> Derive-Secret(., "exporter master secret 1",
>       |                     ClientHello...Server Finished)
>       |                     = exporter_secret_1
>       |
>       +-----> Derive-Secret(., "exporter master secret 2",
>                             ClientHello...Server Finished)
>                             = exporter_secret_2
> 
> Or:
> 
> Master Secret
>       |
>       |
>       +-----> Derive-Secret(., "exporter master secret",
>                             ClientHello...Server Finished)
>                             = exporter_secret
>                                  |
>                                  +-----> Derive-Secret(., "exporter secret
> 1",
>                                  |                     what_exactly)
>                                  |                     = exporter_secret_1
>                                  |
>                                  |
>                                  +-----> Derive-Secret(., "exporter secret
> 2",
>                                                        what_exactly)
>                                                        = exporter_secret_2
> 
> 
> (I wrote "what exactly" since I am not sure what do you plan to include
> there.)

I interpretted it to be something like follows:

Master secret
 + Derive-Secret(label="exporter master secret", context=ClientHello...ServerFinished)
    + Derive-Secret(label=EXPORTER-FOO, context=<blank>)
      + Derive-Secret(label="exporter", context=<context#1>)
      + Derive-Secret(label="exporter", context=<context#2>)
    + Derive-Secret(label=EXPORTER-BAR, context=<blank>)
      + Derive-Secret(label="exporter", context=<context#1>)
      + Derive-Secret(label="exporter", context=<context#3>)


But I don't know how useful that would be, as it requires knowing all
labels one is going to use (or one needs to keep EMS around anyway).


-Ilari

[TLS] Adding an additional step to exporters Martin Thomson
Re: [TLS] Adding an additional step to exporters Sean Turner
Re: [TLS] Adding an additional step to exporters Felix Günther
Re: [TLS] Adding an additional step to exporters Martin Thomson
Re: [TLS] Adding an additional step to exporters Ilari Liusvaara
Re: [TLS] Adding an additional step to exporters Hugo Krawczyk
Re: [TLS] Adding an additional step to exporters Ilari Liusvaara
Re: [TLS] Adding an additional step to exporters Martin Thomson
Re: [TLS] Adding an additional step to exporters Martin Thomson