Re: [TLS] Clarifications and questions: TLS1.3 - Static RSA and AEAD

[Michael StJohns <[e-mail]>]

On 5/27/2014 12:58 PM, Blumenthal, Uri - 0558 - MITLL wrote:
>
>     You want cryptographic isolation between the key material produced
>     from the master secret and the iv material produced from the IV,
>     and the current spec doesn't do that.  See my last message to
>     EKR.  One way to create this isolation is to derive the random IV
>     data from a key that is different from the master secret - either
>     a subkey derived from the master secret, or from a second key
>     derived from the premaster.
>
>
> You want the separation to be on a higher level.
>
> I'd be happy with either one of the above.
>
>       A second way to create the isolation is to not generate the IV
>     data from a key value and instead simply use an entropy expansion
>     function on the client_random and server_random to generate the IVs.
>
>
> Should be fine too, assuming at least one *_random is good enough.
>

That latter is my preference.