Re: [TLS] confirming the room’s consensus: adopt HKDF PRF for TLS 1.3

[Sean Turner <[e-mail]>]

On Apr 01, 2015, at 14:53, Nikos Mavrogiannopoulos <[e-mail]> wrote:

> ----- Original Message -----
>> This message is to confirm the consensus reached @ the IETF 92 TLS session in
>> Dallas and at the TLS Interim in Seattle to make the TLS 1.3 PRF be an
>> HKDF-based PRF (see
>> http://datatracker.ietf.org/doc/rfc5869/?include_text=1).
>> Please indicate whether or not you agree with the consensus by 2015-04-17.
>> If not, please indicate why.  Also, please note that we’re interested in
>> uncovering new issues not rehashing issues already discussed.
> 
> I believe the question is totally unwarranteed. No-one has presented any argument
> on why the TLS PRF is not sufficient for its purpose. The only arguments presented
> are theoretical advantages of HKDF, which are fine, but do they add value to TLS?
> Does the advantages of HKDF translate into weaknesses of the TLS PRF?

Both ekr and I queued the whole discussion up with there’s "nothing really wrong" with the PRF as far as we know.  The discussion in Dallas starts about 2:31:15 on audio stream - listen for a muffled ekr saying "oh god":
http://www.ietf.org/audio/ietf92/ietf92-oak-20150326-0900-am1.mp3

At about 2:34:47 of the audio stream, Hugo discuses some of the “sub-optimal” aspects of the current PRF.

> So no matter the output of that poll the result will be an uneducated guess. In all cases
> it is alarming to see the easiness with which the protocol is being rewritten completely.
> Now its only similarity with TLS 1.2 is the TLS acronym. Would that rewrite bring value
> in par with the efford needed for the rewrite? Would it make us safer in 2030 or are we
> simply apply yesterday's technology today?

I guess I don’t follow - the PRF changed in previous versions and we kept the “TLS” moniker.

spt

> regards,
> Nikos