Re: [TLS] confirming the room’s consensus: adopt HKDF PRF for TLS 1.3

[Michael StJohns <[e-mail]>]

On 4/26/2015 4:20 PM, Hugo Krawczyk wrote:
>
>     You can include the length term in info, but it won't be enforced
>     by the HSM and depending on the format of the INFO field could
>     actually be spoofed as this is all user supplied info that isn't
>     known to be related to the actual desired output length.
>
>
>  Adding the length is not a solution to spoofing attacks- it will not 
> differentiate between keys of the same length.
> You cannot compensate via the KDF for unauthorized access to the HSM. 
> If the HSM doesn't enforce an access policy, it is the HSM problem, 
> not something to solve via the KDF or via TLS 1.3 spec.
> ​

Adding the length is not a solution to spoofing attacks and does not 
differentiate between keys of the same length, but it will differentiate 
between keys of _different_ lengths which is where the attack comes 
in.   The problem is not in the math of the KDF, but in the HSMs ability 
to determine how to convert key stream material into concrete keys in a 
manner that doesn't subject them to attack.

If I have a key that's derived from another key, I would like that it 
not be trivial for an attacker who has access to the HSM to extract that 
derived key.  I believe that making the change to add the length makes 
it difficult to do such extraction and apparently(?) so did the 
reviewers of SP800-108(?).

Mike