[TLS] Issue 555: Generate IVs in one HKDF invocation?

Eric Rescorla <ekr@rtfm.com> Wed, 17 August 2016 22:10 UTC

MIME-Version: 1.0
From: Eric Rescorla <ekr@rtfm.com>
Date: Wed, 17 Aug 2016 15:09:51 -0700
Message-ID: <CABcZeBMCoEhsDTTioQVCRP=qYLnijS+8wtGFLw1kyYy+fkfyhQ@mail.gmail.com>
To: "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c086548d67863053a4bbb26"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/XTDMnWu4TnQf_JWopSXMqxVLIYg>
Subject: [TLS] Issue 555: Generate IVs in one HKDF invocation?
Precedence: list

Issue:
  https://github.com/tlswg/tls13-spec/issues/555

ADL suggested that we could slightly reduce the number of HKDF
computations by generating the IVs as a single block rather than
with individual HKDF-Expands. You can't generally do this kind
of slice-and-dice and preserve the key boundary, but IVs are
public anyway.

At least for NSS, this makes things slightly more complicated
because we generate the directional traffic keys independently,
but it's also not a big deal to change if people want.

Comments in favor or against?

Re: [TLS] Issue 555: Generate IVs in one HKDF inv… Ilari Liusvaara
Re: [TLS] Issue 555: Generate IVs in one HKDF inv… Eric Rescorla
Re: [TLS] Issue 555: Generate IVs in one HKDF inv… Brian Smith
Re: [TLS] Issue 555: Generate IVs in one HKDF inv… David Benjamin
[TLS] Issue 555: Generate IVs in one HKDF invocat… Eric Rescorla