Re: [TLS] Computation of static secret in anonymous DH

On Wed, Jun 17, 2015 at 1:25 AM, Ilari Liusvaara <
ilari.liusvaara@elisanet.fi> wrote:

> On Wed, Jun 17, 2015 at 07:33:31AM +0000, Douglas Stebila wrote:
> > In the DH-based draft of TLS 1.3 (
> https://github.com/ekr/tls13-spec/blob/ietf92_materials/draft-ietf-tls-tls13-dh-based.txt
> ),
> > how is the ServerParameters message containing the static secret SS
> > constructed in the unauthenticated setting?
>
> There's much newer version in ekr/tls13-spec#WIP_draft_06
> (seems to have fixed most of the mistakes in the original WIP)
>

Don't worry, I'm sure there are plenty of mistakes left!

> There for anonymous setting, seemingly SS is copy of ES, and
> configurations (essentially replacement of ServerParameters) can't
> appear at all (because one needs a certificate to send one).
>

Affirmative.

> I can't figure out what to use as configurations hash part of
> session hash in case there isn't assumed or negotiated
> configuration (some session hashes are seemingly always that
> way, especially things like the one used for handshake key
> derivation).
>

It's empty, but I'll be fixing this.

> It also does not say what master key to use for handshake
> encryption key derivation. I presume tmp2.
>

" For handshake records, this means the ephemeral secret (ES)"

This whole section is still under active development, though.

> Also, I note that seemingly if configuration private key
> gets compromised, one can MITM all sessions using it at
> will (it has finite lifetime, but other than that, I see
> no good way to revoke).

Yes, this seems like an inherent property of anything that
authenticates with a semi-static or static DH key.

-Ekr

>
>
> -Ilari
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>