Re: [TLS] AEAD only for TLS1.3 revisit

[Ilari Liusvaara <[e-mail]>]

On Wed, Oct 01, 2014 at 01:13:14PM -0400, Michael StJohns wrote:
> On 10/1/2014 12:47 PM, Salz, Rich wrote:
> >
> In your equation above, with respect to this thread only, the actual problem
> is not the " + epsilon" but the "- some_crypto_mechanisms" which took away
> all the mechanisms where the integrity key can be isolated from the
> encryption key.  Trying to define new AEAD mechanisms that provide this
> capability *AND* make it in to sufficient commercial stacks becomes an
> interesting problem (and frankly a great deal of work in TLS1.3 that's not
> necessary in TLS1.2).

Actually isolating integrity key from encryption key would require two
MACs, with inner one inner to encryption and with its own subkey.

> The discussion really is about how we're making a number of structural
> changes to TLS in the TLS1.3 draft.  Some of them have interesting and
> possibly unintended consequences (cf the discussion on encrypting the
> handshake with respect to encrypting the SNI extension; or the discussion
> about doing the hash of the handshake mixin with key derivation interacting
> badly with the desire for 1rtt); this particular change had an unintended
> consequence that didn't come to light (at least for me) until I got a
> specific request and tried to figure out how to satisfy it.

What's the problem? It seems that hashing the early handshake is easy
enough (and there ARE attacks without this).

Is this something about hashing in the "identities" or something like
that?


-Ilari