Re: [TLS] Computation of static secret in anonymous DH

[Eric Rescorla <[e-mail]>]

On Wed, Jun 17, 2015 at 8:05 AM, Ilari Liusvaara <
[e-mail]> wrote:

> On Wed, Jun 17, 2015 at 05:56:23AM -0700, Eric Rescorla wrote:
> > On Wed, Jun 17, 2015 at 1:25 AM, Ilari Liusvaara <
> > [e-mail]> wrote:
> >
> > > On Wed, Jun 17, 2015 at 07:33:31AM +0000, Douglas Stebila wrote:
> > > > In the DH-based draft of TLS 1.3 (
> > >
> https://github.com/ekr/tls13-spec/blob/ietf92_materials/draft-ietf-tls-tls13-dh-based.txt
> > > ),
> > > > how is the ServerParameters message containing the static secret SS
> > > > constructed in the unauthenticated setting?
> > >
> > > There's much newer version in ekr/tls13-spec#WIP_draft_06
> > > (seems to have fixed most of the mistakes in the original WIP)
> > >
> >
> > Don't worry, I'm sure there are plenty of mistakes left!
>
> Such as how keys for TLS exporters are derived?


Quite possibly. Hence the WIP designation.


> Trying to
> search for 'export' or 'extractor' only gives changelog
> entry about fixing used key...
>
> Editor's copy says exporters use master secret (not quite
> ideal).
>
> > > It also does not say what master key to use for handshake
> > > encryption key derivation. I presume tmp2.
> > >
> >
> > " For handshake records, this means the ephemeral secret (ES)"
> >
> > This whole section is still under active development, though.
>
> I was thinking about avoiding using ES twice (since it is not
> secured against THS-style attacks, while tmp2 is).


All key derivations include the transcript.

-Ekr