Re: [TLS] HKDF

[Brian Smith <[e-mail]>]

Eric Rescorla <[e-mail]> wrote:
> On Wed, Mar 25, 2015 at 1:47 PM, Brian Smith <[e-mail]> wrote:
>> If the IVs are secret (only shared between the two peers) then I don't
>> see the need to change how they are calculated from the keyblock.
>
> The issue is that in many cases the IV will be handled outside the crypto
> module, and the keys should stay inside the crypto module. The traditional
> slice and dice makes that hard.

When the implementation cares about this, won't it also care that the
nonce/IV is completely managed within the crypto module too?
Otherwise, for certain things like AES-GCM, the application could
attack the crypto module reusing a nonce in order to learn the key.
Using the design I suggested in [1] allows the crypto module to
completely manage the nonce/IV in a way that makes such abuse
impossible. In fact, with that design, the crypto module doesn't even
need to tell the application what the nonces/IVs are. And that can
happen without changing how the nonces are derived from the keyblock.

Conversely, if the crypto module *doesn't* work like that, then it
isn't clear to me that it is actually offering a useful amount of
protection of the key material. It doesn't seem useful to make things
more complicated in order to support that kind of design, which seems
broken.

Cheers,
Brian

[1] https://www.ietf.org/mail-archive/web/tls/current/msg15573.html