Re: [TLS] New drafts: adding input to the TLS master secret

[Paul Hoffman <[e-mail]>]

At 1:35 AM +0100 1/30/10, Stefan Santesson wrote:
>1)  Could/Should the draft say anything more about the benefits?

Not really; I put what I knew into the doc.

>The draft states the undeniable fact that "This mixing creates a
>cryptographic binding of the added material directly into the secret that is
>used to protect the TLS session.  For example, some systems want to be sure
>that there is sufficient randomness in the TLS master_secret"
>
>But is this solution provided because the PRF, unless amended with
>additional entropy, could cause security issues that motivates this change?

The first sentence (mixing) is, as you say, undeniable. Different people want different items cryptographically mixed into the secret. For instance, some people really want the parties' identities mixed in. (Note that I'm not proposing to do that, just saying that some folks want it.)

The second sentence (random) is the motivation for the extension. A PRF which turns out to be weaker than expected might have that weakness shored up by stuffing more random in the master_secret. To date, no PRF weaknesses have ever been made worse by adding random inputs.

>2) What is the added value of defining the amended master secret calculation
>in absence of any extension that provide data to the calculation.
>
>Once such extension is defined, would it not have to more or less duplicate
>the definition provided in this draft? (e.g. see question 3)

There is no value to amending the calculation unless there is at least one extension that will use it. However, do not assume that the only possible valuable extension is for adding randomness; there are others that other folks might want in the future.

>3) How do you decide the order of input from multiple extensions?

That's covered in draft-hoffman-tls-master-secret-input:

   For the calculation of the master secret, the
   extensions MUST be sorted by extension type order.  Note that RFC
   5246 specifies that there can only be one extension per type, and the
   extensions can appear in mixed order.

--Paul Hoffman, Director
--VPN Consortium