Re: [TLS] HSM-friendly Key Computation

If we're using HKDF-Extract, can we just key off different labels?

-Ekr

On Wed, Apr 22, 2015 at 1:35 PM, Ilari Liusvaara <
ilari.liusvaara@elisanet.fi> wrote:

> On Wed, Apr 22, 2015 at 10:02:50AM -0700, Robert Relyea wrote:
> > On 04/20/2015 09:37 AM, Ilari Liusvaara wrote:
> > >
> > >There are other places in TLS that fundamentally need to (indirectly)
> derive
> > >public data out of secret key material.
> > That's not a a problem. The problem is using the same mechanism to derive
> > the public data that we use to derive the keys.
> > It's even OK to use the same secret key for both (from an HSM POV).
> >
> > What Michael is saying is that there are existing functions for both KDF
> > (secret material -> key) and Mac (secret material-> unique public data).
> > He's requesting that TLS not have it's own versions of these functions.
>
> So would using two different PRF functions, one for parts that don't
> downgrade and another for parts that do downgrade (e.g. IV derivation,
> unique / finished calculations, exporter calculations, etc..) solve the
> issue?
>
> (Of course, the two functions should be closely related, so not to
> annoy software implementations too much)...
>
>
> -Ilari
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>