Re: [TLS] TLS and hardware security modules - some issues related to PKCS11

["Juraj Somorovsky" <[e-mail]>]

On 09/21/2013 09:09 PM, Michael StJohns wrote:
> Thanks for this.  I think it can be fixed though and relatively simply,
> but will require changes to the key expansion step that are a bit more
> than I suggested:
> 
> E.g. in addition to the master_key, label and random data being fed into
> the KDF, also feed in - in order for each output key - 2 or 4 bytes each
> that describe the length of the key.  And that's taken directly from the
> inputs for the key lengths requested.
> 
> That means that any time you vary the length of ANY key in the key
> expansion, the entire key stream changes.
> 
> It also means that there isn't a need for a separate IV sub key for the
> key expansion stage (I think....)
I do not think this is enough to solve this problem. There are
algorithms that have the same key and IV lengths....e.g. an AES-128 key
has the same length as the IV used in AES-CBC. I think this would break
your key derivation???

An additional problem is that the same key would be used for the same
block ciphers in different modes of operation, e.g. AES-CBC would use
the same key as AES-GCM.

As mentioned in my previous post, a solution would be to derive the
material based on the master secret and the encryption scheme / IV it is
used for. For example you could derive :
- a symmetric key for AES-GCM:
k_GCM = PRF(master_secret, "AES_GCM", [further params])
- a symmetric key for AES-CBC:
k_CBC = PRF(master_secret, "AES_CBC", [further params])
- initialization vector:
IV = PRF(master_secret, "IV", [further params])

This solution however assumes that if k_GCM is generated, the attacker
cannot enforce the PKCS11 module to use it for the AES-CBC computation.
Again, I am not that familiar with PKCS11...can this be achieved in a
typical PKCS11 module?

In other words: can a PKCS11 module admin/user enforce that if a
specific material is derived with a "AES-GCM" parameter, the resulted
key can only be used in AES-GCM?

Thanks
Juraj