Re: [TLS] IV Generation was: Clarifications and questions: TLS1.3 - Static RSA and AEAD

[Michael StJohns <[e-mail]>]

On 5/27/2014 5:21 PM, Martin Rex wrote:
> Michael StJohns wrote:
>>
>> Continuing, the master secret *is* used explicitly as a MAC key
>> (finished message) and as a master key for a KDF (key expansion).
> Unless you're using a NULL encryption ciphersuite, the Finished
> messages _are_ encrypted, rather than exchanged in the clear,
> and there is a reason why the Finished message is truncated.
>
> For the two communication peers that are involved (TLS client and
> TLS server), the master secret is a shared secret.  For any attacker,
> the finished messages are not visible (encrypted).

Not really sure why this is relevant.  Are you arguing that the finished 
MAC isn't actually a MAC or the finished MAC isn't necessary if the 
handshake is encrypted, or isn't necessary if these messages are 
encrypted? Or that the key for the MAC isn't actually a key?

As a general comment, the security of the TLS handshake protocol 
shouldn't a) depend on the encryption of the handshake messages, or b) 
depend on the security of any part of the negotiated cryptographic suite 
except that specifically required for the handshake (and right now, 
that's only the PRF).  (e.g. I can't assume that the cipher suite isn't 
NULL for encryption when designing the security).

Encryption of the handshake is "nice to have" and "provides privacy for 
some elements of the handshake (e.g. certificates)", but isn't actually 
critical for the security (integrity/source authentication/key 
agreement/correctness/prevention of MITM attacks) of the protocol.


>
>> Seriously though - no.   Basically if you share it, it's no longer an
>> entropy pool, but a key.
> There is a necessity to share the master secret with your communication
> peer so that both can derive the same new secrets from it.
>

Hence my point that the master secret is a key, and not an entropy pool.

You've made a claim about the master secret (and the PRF) being more 
like an entropy pool.  Is there any literature to support your view?

Later, Mike