Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[Nelson B Bolyard <[e-mail]>]

On 2009-11-26 08:04 PST, Blumenthal, Uri - 0662 - MITLL wrote:
> Yes, previous_verify_data MUST be a part of the input to the PRF. What Yoav
> Nir said (XOR-ing it with the master_secret), should work (out of hand -
> anybody sees a problem with it?).

Yes.  In Hardware Security Modules that pass certain FIPS security levels,
and implement the PRF in hardware, a change to the use of the PRF that
causes data (non-key material) to get combined with key material (the master
secret) would require introduction of new paths, a big change, would take
at least a year to get all the approvals.

If you want to change inputs to the PRF, just keep keys separate from
non-key data.  Combine new non-key data with other existing non-key data
inputs, not with key data inputs.