[TLS] cryptanalysis vs. encrypted parts of the TLS handshake [was: Re: Simplifying the proof]

[Daniel Kahn Gillmor <[e-mail]>]

Hi Markulf--

Thanks for your post encouraging ongoing collaboration between the 
theoretical and engineering sides of the security community.  This is a 
worthwhile goal.

Can you provide clarification on this point below?

On 09/02/2014 11:03 AM, Markulf Kohlweiss wrote:
> * To remove distraction and be closer to standard models like Bellare
>    & Rogaway, we would prefer unencrypted finished messages. In
>    practice this means that the finished message should be sent before
>    the ChangeCipherSuite message.

I understand that the goal here is to be able to improve cryptanalysis 
of the confidentiality guarantees provided to the application data 
stream.  Does this mean that the finished message needs to be 
unencrypted, or does it just mean that the finished message (and/or 
other parts of the handshake) should not be encrypted using the same 
keying material/session as the application data?

That is, would the cryptanalytic side of the community be OK with having 
the handshake messages encrypted as long as they were using keys/session 
material that are distinct from the keys/session material used for the 
application data?

Part of the TLS WG's charter for 1.3 is to encrypt as much of the 
handshake data as possible.  I don't want that goal to interfere with 
theoretical cryptanalysis, but there are serious privacy concerns 
related to the handshake data that is sent in the clear in TLS 1.2 and 
below.  If the cryptanalysis community insists on entirely cleartext 
handshake data, that will be in direct opposition to one of the two 
major prongs of the TLS charter.

(as an aside, it would be nice to get some cryptanalytic review of any 
confidentiality/integrity we attempt to provide for the handshake 
material itself, though i understand this may be a separate question 
from the confidentiality/integrity guarantees we strive for in the 
application data)

Regards,

	--dkg