Re: [TLS] confirming the room’s consensus: adopt HKDF PRF for TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

----- Original Message -----
> This message is to confirm the consensus reached @ the IETF 92 TLS session in
> Dallas and at the TLS Interim in Seattle to make the TLS 1.3 PRF be an
> HKDF-based PRF (see
> http://datatracker.ietf.org/doc/rfc5869/?include_text=1).
> Please indicate whether or not you agree with the consensus by 2015-04-17.
> If not, please indicate why.  Also, please note that we’re interested in
> uncovering new issues not rehashing issues already discussed.

I believe the question is totally unwarranteed. No-one has presented any argument
on why the TLS PRF is not sufficient for its purpose. The only arguments presented
are theoretical advantages of HKDF, which are fine, but do they add value to TLS?
Does the advantages of HKDF translate into weaknesses of the TLS PRF?

So no matter the output of that poll the result will be an uneducated guess. In all cases
it is alarming to see the easiness with which the protocol is being rewritten completely.
Now its only similarity with TLS 1.2 is the TLS acronym. Would that rewrite bring value
in par with the efford needed for the rewrite? Would it make us safer in 2030 or are we
simply apply yesterday's technology today?

regards,
Nikos