Re: [TLS] PR #699: Simplify traffic key expansion

[Kazuho Oku <[e-mail]>]

Hi Martin,

Thank you for your response.

2016-10-21 8:05 GMT+09:00 Martin Thomson <[e-mail]>:
> On 21 October 2016 at 06:52, Kazuho Oku <[e-mail]> wrote:
>> Is there any need to expand resumption_psk from resumption_secret?
>>
>> To me, it is unclear why resumption_secret cannot be used directly as
>> a psk, since the two values have the same lengths and since the secret
>> is only used for deriving the psk.
>>
>> Maybe is this something we could also simplify?
>
> draft-17 makes a simplification along the lines you suggested.  Note
> that this wasn't as easy to get right as you might have imagined for a
> bunch of reasons.

Observing the differences between draft-16 and 17, I understand that
it has become much simpler. In fact, I have decided to skip
implementing the draft-16 style NewSessionTicket and go directly to
implementing draft-17, since the newer draft seems easier to
implement. Thank you for making those adjustments to the draft.

That said, the point I am trying to raise is not something that was
fixed in draft-17. It's something that has become apparent in draft-17
thanks to the simplifications being introduced.

In draft-16, resumption_secret was used for two purposes: generate
resumption_psk and resumption_context. So it made sense to derive
resumption_psk from resumption_secret.

But in draft-17, my understanding is that resumption_context has been
abolished. As the result, generation of resumption_psk has been the
only use of resumption_secret.

That is the reason I thought it might be worthwhile to remove the
following formula in section 4.5.1:

   resumption_psk = HKDF-Expand-Label(resumption_secret,
                                      "resumption psk", "", Hash.Length)

and use resumption_secret as the psk.

Thank you in advance. Please forgive me if I am missing something.

-- 
Kazuho Oku