Re: [TLS] HSM-friendly Key Computation

[Ilari Liusvaara <[e-mail]>]

On Wed, Apr 22, 2015 at 10:02:50AM -0700, Robert Relyea wrote:
> On 04/20/2015 09:37 AM, Ilari Liusvaara wrote:
> >
> >There are other places in TLS that fundamentally need to (indirectly) derive
> >public data out of secret key material.
> That's not a a problem. The problem is using the same mechanism to derive
> the public data that we use to derive the keys.
> It's even OK to use the same secret key for both (from an HSM POV).
> 
> What Michael is saying is that there are existing functions for both KDF
> (secret material -> key) and Mac (secret material-> unique public data).
> He's requesting that TLS not have it's own versions of these functions.

So would using two different PRF functions, one for parts that don't
downgrade and another for parts that do downgrade (e.g. IV derivation,
unique / finished calculations, exporter calculations, etc..) solve the
issue?

(Of course, the two functions should be closely related, so not to
annoy software implementations too much)...


-Ilari