Re: [TLS] Pull request for session hash

[Eric Rescorla <[e-mail]>]

On Fri, Nov 7, 2014 at 2:35 PM, Ilari Liusvaara <[e-mail]
> wrote:

> On Fri, Nov 07, 2014 at 02:01:27PM -0800, Eric Rescorla wrote:
> > I've created a preliminary pull request to adapt the session hash fix for
> > TLS 1.3
> > for feedback from the WG.
>
> Quick comment: I presume "{ServerKeyShare}" in figure 2 should be
> "ServerKeyShare" (i.e. not encrypted).


Good catch. Thanks.


> Points to note:
> >
> > - IMPORTANT: Because the initial handshake messages are encrypted
> >   under separate keys from the application data traffic, it seems like we
> > need
> >   to have 2 sets of CCS messages or none. In anticipation of removing
> >   renegotiation (see PR https://github.com/tlswg/tls13-spec/pull/88).
> >   Based on conversations with Alfredo and Martin, it seemed easier
> >   to remove them. Warning: analysis needed here.
>
> I would say that from implementation safety perspective (at least for
> non-D TLS) it is better to do the state transitions implicitly


This seems like a topic where we're going to have a lot of opinions :)

If we do decide to have the CCS, we would restore the previous CCS
after ClientKeyShare/ServerKeyShare and then put a new one after
each side's Finished. I still have the text in git, so I can bring it back.
:)



> > - I created a separate resumption master secret that is fed into the
> >   key hierarchy. This makes the description of that simpler but will
> >   need revisiting if we adopt either Rich's unification of session hash
> >   and tickets or Karthik's PSK-as-tickets unification, but that seemed
> >   like a separate issue.
>
> Oh, on topic of multiple master secrets, which one does TLS-Extractor
> get? :-)


Also a good catch. I suggest we make a new TLS Exporter MS.

-Ekr


>
>
> -Ilari
>