[TLS] Entirely omitting context in draft-ietf-tls-extractor

[Eric Rescorla <[e-mail]>]

During LC, we received a comment from Jouni Malinen that unconditionally
including the context in the PRF created an unnecesssary incompatibility
with exporter-type mechanisms in EAP-TLS and EAP-TTLS which could otherwise
be retconned into being extractor usages. In order to address this, I
propose changing the text to read:


  If no context is provided, it then computes:

         PRF(SecurityParameters.master_secret, label,
             SecurityParameters.client_random +
             SecurityParameters.server_random
             )[length]

  If the context is provided, it computes::

         PRF(SecurityParameters.master_secret, label,
             SecurityParameters.client_random +
             SecurityParameters.server_random +
             context_value_length + context_value
             )[length]

  Where PRF is the TLS PRF in use for the session.  The output is a
  pseudorandom bit string of length bytes generated from the
  master_secret. (This construction allows for interoperability
  with older exporter-type constructions which do not
  use context values, e.g., [RFC5281]).

Any objections?

-Ekr