RE: [TLS] Updated TLS 1.2 I-D

Bodo Moeller wrote:
> If you take into account SSL 3.0, then the PRF already *is* a
> property of the TLS protocol version, though.  And the current TLS
> PRF, with its input-splitting dual-hash construction, is somewhat
> bizarre, so a reasonable simple new PRF, based on a wider hash,
> wouldn't be bad -- providing the advantage that those who want to
> avoid the current TLS PRF in their favorite ciphersuites won't have
> to define additional ciphersuites just to get another PRF, as long
> as they are reasonably happy with the new default if we decide on
> one.

Hmm... this is true. And we do have a precedent for TLS version
dependent properties in ciphersuites: when we added an explicit IV 
for CBC mode ciphersuites in TLS 1.1, we didn't give new numbers
(e.g. "TLS_RSA_WITH_AES_128_CBC_EXPLICITIV_SHA").

So perhaps Eric's proposal (PRF is a property of both the ciphersuite
and protocol version, and for version 1.2, it defaults to the new
to-be-decided PRF unless a ciphersuite spec explicitly says
otherwise) would be simpler after all..

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls