Re: [TLS] Review comments on draft-rescorla-tls-opaque-prf-input-00.txt

Extending the length of the contributed Nonce information in 
the PRF is nicely disclosed, in section 3.2.

What is interesting now is the session resumption 
disclosure. This may explain why Eric is so adamant that he 
can FORCE a new handshake, so he can refresh the extensions 
values for a new TLS Connection?

But, as disclosed, its more confusing than before. Now the 
opaque PRF can only be used in pre-master-secret to master 
secret generation. In the other document and earlier in the 
paper, it seemed opaque PRF was being given a rationale for 
use in final KDF;'s generation of keying material.

Between protocol analysis, hacking some extensions to extend 
the nonce, PRF parameterization, the way it handles session 
resumption and kind of reverses its rationale... this doesn't 
look a polished and finished piece of work. is "feels" like 
work in progress, attempting to apply external policy to 
standards making.

Again, I cannot find any reason not to do this, or be open 
about it!

---------

3.2.  PRF Modifications

   When the opaque PRF input feature is in use, the opaque 
PRF input
   values MUST be mixed into the PRF along with the client 
and server
   random values during the PMS->MS conversion.  Thus, the 
PRF becomes:

          master_secret = PRF(pre_master_secret, "master 
secret",
                              ClientHello.random +
                              ClientHello.opaque_prf_input_value 
+
                              ServerHello.random +
                              ServerHello.opaque_prf_input_value)[0..47];

   Because new extensions may not be introduced in resumed 
handshakes,
   mixing in the opaque PRF inputs during the MS->keying 
material
   conversion would simply involve mixing in the same 
material twice.
   Therefore, the opaque PRF inputs are only used when the 
PMS is
   converted into the MS.

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls