Re: [TLS] Pull request for session hash

[Eric Rescorla <[e-mail]>]

I've posted an updated PR at:

https://github.com/tlswg/tls13-spec/pull/89

Note that I did not restore the ChangeCipherSpec message as my sense of
the WG discussion and private conversations was that people preferred to
have it gone. If you feel strongly about this change one way or the other,
and haven't already posted to the list about it, please do so now, as I'd
like to resolve this and merge this PR this week.

Best,
-Ekr



On Fri, Nov 7, 2014 at 2:01 PM, Eric Rescorla <[e-mail]> wrote:

> I've created a preliminary pull request to adapt the session hash fix for
> TLS 1.3
> for feedback from the WG.
>
> Points to note:
>
> - IMPORTANT: Because the initial handshake messages are encrypted
>   under separate keys from the application data traffic, it seems like we
> need
>   to have 2 sets of CCS messages or none. In anticipation of removing
>   renegotiation (see PR https://github.com/tlswg/tls13-spec/pull/88).
>   Based on conversations with Alfredo and Martin, it seemed easier
>   to remove them. Warning: analysis needed here.
>
> - I created a separate resumption master secret that is fed into the
>   key hierarchy. This makes the description of that simpler but will
>   need revisiting if we adopt either Rich's unification of session hash
>   and tickets or Karthik's PSK-as-tickets unification, but that seemed
>   like a separate issue.
>
> - If we adopt the Update proposal we will also need to split the master
>   keys into two directional keys, but that's distinct as well.
>
> - I still need to add the names of the session hash authors t
>   acknowledgements.
>
> This will probably need another revision before it is ready for merging,
> but
> I wanted to get it out there for feedback.
>
> -Ekr
>
>
>
>