Re: [TLS] GSS-API extension draft available

Jeffrey Altman wrote:
> 
> In RFC 2712 (TLS Kerberos Ciphers) the Kerberos session key is used as
> the pre-master secret.  This mechanism has severe problems because it
> means that each and every TLS session that is created for as long as the
> Kerberos service ticket is valid will use the same pre-master secret.

This looks like an extremely poor choice to me, given the (lack of)
entropy in Kerberos sessions keys, in particular of the installed base
and the predominant interorable enctype when rfc2712 was issued.

> 
> What this proposal does is replace RFC 2712 with a generic GSS-API
> method of generating a unique pre-master secret when used with the GSS
> Kerberos5 mechanism.  GSS-API does not provide a method to extract key
> data from the underlying mechanism because doing so would result in a
> mechanism specific dependency and violate the GSS-API abstraction.

Using the entropy from the GSS-API prf is fine.  Completly ignoring
additional randomness that is available through the regular TLS
handshake looks somewhat strange to me.

I would have expected that one would XOR a GSS-API supplied entropy
for the pre-master secret with a traditional TLS-generated entropy.

-Martin

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls