Re: [TLS] Review comments on draft-rescorla-tls-opaque-prf-input-00.txt

<home_pw@msn.com> writes:
> What is interesting now is the session resumption disclosure. This may
> explain why Eric is so adamant that he can FORCE a new handshake, so
> he can refresh the extensions values for a new TLS Connection?

Peter, it's generally polite not to attribute ulterior motives to
others. 

> But, as disclosed, its more confusing than before. Now the opaque PRF
> can only be used in pre-master-secret to master secret generation. In
> the other document and earlier in the paper, it seemed opaque PRF was
> being given a rationale for use in final KDF;'s generation of keying
> material.

First, I should state that I only have fairly limited insight into
the motivation for this extension. I was asked to help design
something with a particular set of parameters in the way that
would be most tasteful for TLS and that's what I did. I agree
it would be nice to have a more explicit rationale for these
parameters and I'm working on getting one.

That said, not re-mixing the new entropy into the KDF for 
session key generation wasn't an intentional design feature.
It's merely a limitation of the way that session resumption
and extensions interact.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls