Re: [TLS] confirming the room’s consensus: adopt HKDF PRF for TLS 1.3

[Michael StJohns <[e-mail]>]

On 4/1/2015 2:00 PM, Sean Turner wrote:
> This message is to confirm the consensus reached @ the IETF 92 TLS session in Dallas and at the TLS Interim in Seattle to make the TLS 1.3 PRF be an HKDF-based PRF (see http://datatracker.ietf.org/doc/rfc5869/?include_text=1)
>
> Please indicate whether or not you agree with the consensus by 2015-04-17.  If not, please indicate why.  Also, please note that we’re interested in uncovering new issues not rehashing issues already discussed.
>
> Thanks - J&S
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls


I have a large preference to move to a different KDF than we're 
currently using. (And to limit the output of said KDF to key material 
and nothing else).  Deprecating the current TLS KDF will help with 
resolving some HSM related security issues.

I have a medium preference that that KDF be counter based rather than 
recursive (as is the current PRF and HKDF).  I've got a sneaking 
suspicion that doing so would be cleaner to implement in hardware as the 
only field changing with every call to HMAC is that of the counter.

I have a small preference that we cite a more widely accepted/reviewed 
standard than RFC5869 (which is basically the authors republication of 
their original paper or vice versa).  I will note that the author 
claimed in his paper that the IETF was standardizing this, but I can't 
find any data suggesting this actually went through the IETF 
standardization process (vs independent informational RFC submission 
process).  It did garner some review on the CFRG mailing list, but not 
to what I normally think of as comprehensive and resolving all comments.

I wish David et al had ended up completing the work on 
https://datatracker.ietf.org/doc/draft-irtf-cfrg-kdf-uses/, but what's 
there suggests that we could select one of those instead and get a more 
widely acceptable KDF.

All that said, I won't oppose HKDF.

Mike