Re: [TLS] confirming the room’s consensus: adopt HKDF PRF for TLS 1.3

[Michael StJohns <[e-mail]>]

On 4/26/2015 4:20 PM, Hugo Krawczyk wrote:
>
>     See section 7.5 of
>     ​ ​
>     SP800-108 for a discussion of key separation especially paragraph
>     (2) and why this is important.
>
> ​ I agree with section 7.5 and HKDF, and its use in TLS 1.3, fully 
> complies with it. There is no mandatory use of length as input. It is 
> certainly allowed but not mandated. And when allowing it, it is 
> accommodated via the equivalent of the 'info' ​
> ​ field:
> /"different input data strings (e.g. Label || 0x00 || Context || [L]2) 
> shall be used for different executions".
> /Length is an example and not even listed in the explicit examples at 
> the top of page 19.


You missed:

> The compromise of the keying material output from one of the 
> executions of the KDF must not degrade the security of any of the 
> keying material output from the other executions of the KDF,

Two calls to the KDF that are designed to produce the same key material 
with the same exact characteristics is fine.  But when you can call the 
KDF multiple times with the same input data and assign the output key 
stream to different lengths of keys, you have a problem.

I can do what I said - call and compromise the single byte generation of 
a key with the same input master key and INFO, and repeat it with 
increasing lengths to extract the entire key stream. I think that counts 
as cross compromise.

Later, Mike