Re: [TLS] RFC5487 PSK Key Exchange Algorithm with SHA-256/384. Premaster secret if ciphersuites negotiated for TLS V1.2?

[Manuel Pégourié-Gonnard <[e-mail]>]

Hi,

Sorry for replying so late, I hope this reply is still useful.

On 20/09/2014 09:51, Fox Arcadia wrote:
>  Note 2: Using zeroes for "other_secret" effectively means that
>       only the HMAC-SHA1 part (but not the HMAC-MD5 part) of the TLS PRF
>       is used when constructing the master secret.  This was considered
>       more elegant from an analytical viewpoint than, for instance,
>       using the same key for both the HMAC-MD5 and HMAC-SHA1 parts.  See
>       [KRAWCZYK <http://tools.ietf.org/html/rfc4279#ref-KRAWCZYK>] for
> a more detailed rationale.
> 
IMO, this is only a rationale for using the zeroes, not a normative part.

> but if using a PRF defined in TLS V1.2, then HMAC-MD5 is not used but
> the HMAC defined by the PRF.
> 
> And, in that case, part of the used premaster is zeroes.
> 
Yes, in that case part of the PMS is zeroes, and it's fed to the TLS PRF (using
SHA256) as is, including the zeroes.

At least, that's what we do in PolarSSL and we never had interop issues (tested
regularly with OpenSSL and GnuTLS at least).

> should we in that case reuse PSK for other_secret?
> 
Nope.

Manuel.