Re: [TLS] Kill Finished (and other tricks for hardware)

[Michael StJohns <[e-mail]>]

On 4/17/2014 9:03 PM, Watson Ladd wrote:
>
> Finished dies. Instead we hash the entire handshake, certs and all
> into the master secret. This has the side effect of making life for
> cryptographers a lot nicer. I've not figured out resumption quite yet:
> maybe this is a problem there. I've also probably missed some other
> outputs that need munging or replacements.
>
> This way the PRF is only used to generate keys, so it can be marked at
> such. There aren't any security implications: we've replaced finished
> with the master secret hashing, so the only way to get two identical
> master secrets is from identical exchanges.
>
>

Not quite.  You missed that IVs are generated using the PRF and that's 
another problem.


My PRF proposal is to change the PRF to a counter based PRF

prf_step (i, secret, label, context, total_length) =
      MAC (secret, i + label + 0x00 + context + total_length); // i and 
total_length are uint32 big endian

prf_data (secret, label, context, total_length) =
      CONCAT (i = 1 to CEIL(total_length/blocksize), prf_step (i, 
secret, label, context, total_length))[0..total_length-1];


For deriving keys, you use the above construct and a master secret. For 
using this for the production of random public data (e.g. IVs), you use 
a '0' key of the appropriate length.  The externalized functions are the 
KDF function (which passes in a key) and the DRBG (deterministic random 
bit generator) (which doesn't pass in a key), but the underlying 
implementation is common.  The PRF function is never externalized.

The above construct is the same as defined in NIST SP800-108 (no, not 
dual EC...) and is similar to KDF and DRBG constructs used with X9.63, 
ECDH etc

Mike