Re: [TLS] Pull request for session hash

Eric Rescorla <ekr@rtfm.com> Sat, 08 November 2014 00:35 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC0A31A007C for <tls@ietfa.amsl.com>; Fri, 7 Nov 2014 16:35:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9l33EhO9oLqN for <tls@ietfa.amsl.com>; Fri, 7 Nov 2014 16:35:51 -0800 (PST)
Received: from mail-wi0-f181.google.com (mail-wi0-f181.google.com [209.85.212.181]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38CCA1A000E for <tls@ietf.org>; Fri, 7 Nov 2014 16:35:51 -0800 (PST)
Received: by mail-wi0-f181.google.com with SMTP id n3so6063583wiv.8 for <tls@ietf.org>; Fri, 07 Nov 2014 16:35:50 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=yXPIXmCt/dsDfs6FpIsCRy/Bj89+uvLYOdquoSLKnLo=; b=QgGJLGLYkoSHHj3012f0k5TSwtuTyrYy4npxjmKV54o/j0mMjfFU1KTqWim2CLMwne QJdy4VU8NEDQ51RArADiLPnCWh6733vKXIw0u2WgDjIdlEyNZ/OyrT8ZZlexOJE08Dxy 14fyjO9PwVnLs9se4H6LenkLlciIubwbV72vENLmx0Jsr7umJJvcQWbgFR32+HnF7H8Q fKHxKYgi2q+N9+l4cMRiEXmigwiHFbXJzBJiS1ZdIS7HiJmPDVEFKOYYyb7Dik2aR6J1 baBoJWv6DSMjRT4FDErojIZQCRjv4qGTdmXUszXjZ2dNnScAPxVfifGIlqsswCiYORPE JJpw==
X-Gm-Message-State: ALoCoQm0RSynLkHyv5uC0SKFuIOVfN5Y0ml4QCq1SaDppcgE1nGa5mbur0cr3Q3MOjIaxX4MBA1V
X-Received: by 10.180.108.43 with SMTP id hh11mr9563417wib.80.1415406949969; Fri, 07 Nov 2014 16:35:49 -0800 (PST)
MIME-Version: 1.0
Received: by 10.216.49.198 with HTTP; Fri, 7 Nov 2014 16:35:09 -0800 (PST)
In-Reply-To: <20141107223508.GA23136@LK-Perkele-VII>
References: <CABcZeBNj2n-UM-qwVH8PSV+7MgS6kNxzqQZ20J3DtfZ8tLg9-Q@mail.gmail.com> <20141107223508.GA23136@LK-Perkele-VII>
From: Eric Rescorla <ekr@rtfm.com>
Date: Fri, 7 Nov 2014 16:35:09 -0800
Message-ID: <CABcZeBNxDi=804-u4BC28q5New_fk5DST=k6FzdNLeFMiCkRCA@mail.gmail.com>
To: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Content-Type: multipart/alternative; boundary=089e0122950a77469005074e1c0f
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/cU0Q7waEzC1fcJmsPMDAcZ1xTBw
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Pull request for session hash
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 08 Nov 2014 00:35:53 -0000

On Fri, Nov 7, 2014 at 2:35 PM, Ilari Liusvaara <ilari.liusvaara@elisanet.fi
> wrote:

> On Fri, Nov 07, 2014 at 02:01:27PM -0800, Eric Rescorla wrote:
> > I've created a preliminary pull request to adapt the session hash fix for
> > TLS 1.3
> > for feedback from the WG.
>
> Quick comment: I presume "{ServerKeyShare}" in figure 2 should be
> "ServerKeyShare" (i.e. not encrypted).


Good catch. Thanks.


> Points to note:
> >
> > - IMPORTANT: Because the initial handshake messages are encrypted
> >   under separate keys from the application data traffic, it seems like we
> > need
> >   to have 2 sets of CCS messages or none. In anticipation of removing
> >   renegotiation (see PR https://github.com/tlswg/tls13-spec/pull/88).
> >   Based on conversations with Alfredo and Martin, it seemed easier
> >   to remove them. Warning: analysis needed here.
>
> I would say that from implementation safety perspective (at least for
> non-D TLS) it is better to do the state transitions implicitly


This seems like a topic where we're going to have a lot of opinions :)

If we do decide to have the CCS, we would restore the previous CCS
after ClientKeyShare/ServerKeyShare and then put a new one after
each side's Finished. I still have the text in git, so I can bring it back.
:)



> > - I created a separate resumption master secret that is fed into the
> >   key hierarchy. This makes the description of that simpler but will
> >   need revisiting if we adopt either Rich's unification of session hash
> >   and tickets or Karthik's PSK-as-tickets unification, but that seemed
> >   like a separate issue.
>
> Oh, on topic of multiple master secrets, which one does TLS-Extractor
> get? :-)


Also a good catch. I suggest we make a new TLS Exporter MS.

-Ekr


>
>
> -Ilari
>