Re: [TLS] Computation of static secret in anonymous DH

Ilari Liusvaara <> Fri, 31 July 2015 16:42 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 6DCEF1B2E7B for <>; Fri, 31 Jul 2015 09:42:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.501
X-Spam-Status: No, score=-0.501 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 7LD2EUTm7g2Z for <>; Fri, 31 Jul 2015 09:42:24 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 6B5081B2E61 for <>; Fri, 31 Jul 2015 09:42:15 -0700 (PDT)
Received: from LK-Perkele-VII ( []) by (Postfix) with ESMTP id EFE18414C; Fri, 31 Jul 2015 19:42:12 +0300 (EEST)
Date: Fri, 31 Jul 2015 19:42:12 +0300
From: Ilari Liusvaara <>
To: Nico Williams <>
Message-ID: <20150731164212.GA28398@LK-Perkele-VII>
References: <> <20150617082529.GA17280@LK-Perkele-VII> <> <20150617150505.GA19959@LK-Perkele-VII> <> <20150626085008.GA25187@LK-Perkele-VII> <> <20150626165415.GA28534@LK-Perkele-VII> <> <20150626184128.GG6117@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <20150626184128.GG6117@localhost>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: Ilari Liusvaara <>
Archived-At: <>
Cc: "" <>
Subject: Re: [TLS] Computation of static secret in anonymous DH
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 31 Jul 2015 16:42:35 -0000

On Fri, Jun 26, 2015 at 01:41:29PM -0500, Nico Williams wrote:
> tls-unique depends on the Finished message strongly binding the entire
> transcript up to that point.  I find this elegant (despite the
> resumption problem, which anyways, should be fixed by the session hash)
> and easy to understand and analyze.
> If the Finished message no longer has this property in 1.3 then that's a
> problem for tls-unique, and we'd have to fix one or the other.  Surely
> 1.3 will have some handshake message that binds the transcript, and why
> that wouldn't be the Finished message is beyond me (but I am missing a
> lot of the 1.3 context, so please forgive and inform me).

Also, it turns out some are assuming tls-unique is both connection nonce
and secret value. :-/

I don't think the present construct for Finished values is appropriate
for such values, which means one would have to redefine tls-unique
so it meets the need.

(TLS-Exporter values already look to be secret and connection
nonces, and I have already seen stuff relying on both properties).

Basically, the value needs to derive from both "master secret" (to make
it secret) and session hash /w configs (to make it connection