[TLS] Extended nonces

Folks,

Some folks from the USG have recently raised a requirement with me that
I thought deserved some consideration from the WG.

The issue is that they would like to have the client and server provide
some opaque (to TLS) but structured data which is then fed into the PRF
so that the traffic keys depend on it. Because the data is longer than
32 bytes it can't be packed into the Random structure and because it's
structured and needs to be parsed on the other end, it can't be hashed
and then placed in the Random.

My thought was that they should define a new extension, something
like:

struct {
       opaque material<255>;
} PublicKeyingMaterial;

By offering this extension the client would be saying:

1. I want to do this extension, here's my data.
2. Please provide your own data.

If the server doesn't respond with the extension it's 
not used.

We would then mix these into the PRF as follows:

  master_secret = PRF(pre_master_secret, "master secret",
                  ClientHello.random + Client.PublicKeyingMaterial
                + ServerHello.random + 
Server.PublicKeyingMaterial)[0..47];

Do people see a problem with this?

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls