Re: [TLS] HSM-friendly Key Computation

[Ilari Liusvaara <[e-mail]>]

On Fri, Apr 24, 2015 at 10:28:32AM -0700, Watson Ladd wrote:
> On Apr 24, 2015 10:13 AM, "Joseph Salowey" <[e-mail]> wrote:
> >
> >
> >
> > [Joe] I've having trouble understanding what exactly you are designing
> > here, is it the interface to a specific HSM or is it the TLS 1.3 key
> > derivation or is it something else? I think we need to make sure that we
> > have the requirements defined for the TLS 1.3 key derivation.

It looks to boil down to designing how to encode inputs to the underlying
KDF.

("looks", because I think I am just beginning to figure out what the heck
is actually wanted).

> > Its not clear to me what the problem is with just including the context
> > label, session hash and possibly length.   The context label would
> > differentiate between derived key material for different purposes.  For
> > example, public and private data would use different context labels.  One
> > would also probably want to include the cipher suite ID in the context
> > label for keys derived for encryption.

Well, in one mail, Mike says that context labels are not enough.

He apparently wants for KDF to take type(s), export flag(s) and length(s)
of key(s) to generate as parameters. And then stuff those to info/seed
field (along label and such).

Also, looks like he would prefer that different encryption algorithms
have different types (e.g. AES-GCM vs. Chacha20-Poly1305).

(Again, the comment above applies).

> The issue is the hardware has to enforce the usage of the derived keys. I
> think this will restrict our encoding significantly,  perhaps turning it
> into some bitfields. Asking hardware to understand context labels is going
> to make it not hardware anymore.

Well, most of the "Hardware" here is actually "software", just running on
special-purpose hardware.

> Of course, there are other approaches that offer most of the gains without
> these costs like separate fixed function terminators, or keeping only a few
> keys secret.

Fixed function terminators? Also, what keys to keep secret does not fix
things, since there are some fundamential secret->public derivations.



-Ilari