Re: [TLS] Re-thinking OPTLS

[Hugo Krawczyk <[e-mail]>]

I thought that was what you meant but at least Watson seemed to be
interpreting in the arithmetic sense and he was right to point out that it
would be insecure to do so.

On Sat, Nov 22, 2014 at 6:29 PM, Eric Rescorla <[e-mail]> wrote:

>
>
> On Sat, Nov 22, 2014 at 3:09 PM, Hugo Krawczyk <[e-mail]>
> wrote:
>
>> See below on the issue of key derivation
>>
>> On Sat, Nov 22, 2014 at 1:14 AM, Martin Thomson <[e-mail]
>> > wrote:
>>
>>> On 21 November 2014 19:29, Hugo Krawczyk <[e-mail]> wrote:
>>> > I am glad to hear this too. Please let me know what the sources of
>>> perceived
>>> > complexity are.
>>>
>>> ​​
>>> The only items of note were:
>>>  - the second update to the handshake protection under g^{xs}+g^{xy}.
>>> We all realized that this was trivially addressed (ekr had a slide at
>>> the meeting that showed an easy simplification, which should be in the
>>> meeting materials).
>>>
>>
>> ​I haven't seen these slides and didn't know about them.
>> The derivation of keys based on g^{xs} and g^{xy} does NOT use a sum or
>> any
>> other algebraic combination (although some combinations are secure, most
>> are
>> not, and identifying the good ones is non-trivial).
>>
>
> Note, I didn't intend addition (and I suspect Martin didn't either). I was
> just using
> '+' as shorthand for "both" and being vague about the details of the
> key derivation (as you suggest below). Sorry about the confusion.
>
> -Ekr
>
>
>
>