Re: [TLS] New drafts: adding input to the TLS master secret

[Simon Josefsson <[e-mail]>]

Paul Hoffman <[e-mail]> writes:

>>There is one thing in draft-hoffman-tls-additional-random-ext-00.txt
>>that bothers me: There is no requirement that additional random data is
>>generated using cryptographic principles.  This means the extension can
>>be used as a general-purpose extension mechanism to exchange data that
>>has meaning to, for example, some middle-ware that sits between the
>>client and server.
>>
>>Is this the intention?  I'm assuming no, and that the
>>additional_random_value actually are intended to be, well, just an
>>additional random value.
>
> Correct. That's why the document says:
>    The recipient of an additional_random extension MUST NOT try to parse
>    the additional_random_value.

I noticed that, but as I (perhaps incorrectly) interpreted "recipient"
to mean "client or server", I was left with an uncertainty whether or
not the extension was intended for transporting data (e.g.,
authorization information) intended for middle-ware.

>>Therefor, I would suggest that a new requirement is added:
>>
>>   The client and server MUST generate the additional_random_value data
>>   using a secure random number generator.  [RANDOM] provides guidance
>>   on the generation of random values.
>>...
>>   [RANDOM]   Eastlake, D., 3rd, Schiller, J., and S. Crocker,
>>              "Randomness Requirements for Security", BCP 106, RFC 4086,
>>              June 2005.
>
> This is a great addition, thanks. It will be in the -01.

That solves my issues with two documents, and I support their
publication.

Thanks,
Simon