Re: [TLS] New Key derivations for TLS1.3

[Wan-Teh Chang <[e-mail]>]

On Sat, Sep 21, 2013 at 12:29 PM, Michael StJohns
<[e-mail]> wrote:
> Following up on the previous discussion, I propose the following changes to
> the key derivation steps for TLS.  This adds a length field for each key
> being derived to the PRF seed value.  For the pre-master to master secret
> derivation, this is a single 32 bit length field of value 48.  For the
> master to key expansion derivation, these are 6 32 bit fields each
> representing the length of one of the keys (or IVs to be derived).
>
> By doing this, varying the length of any one of the sub keys completely
> changes the key stream.  That prevents the type of attack described by
> Juraj.

I like this proposal!

> I spec'd 6 fields for the key expansion derivation instead of three to make
> this completely general - and to allow it to be used with the key material
> export RFCs.

Could you elaborate on how your proposed change affects the TLS keying
material exporter RFCs?

Thanks,
Wan-Teh Chang