Re: [TLS] Re-thinking OPTLS

[Hugo Krawczyk <[e-mail]>]

See below on the issue of key derivation

On Sat, Nov 22, 2014 at 1:14 AM, Martin Thomson <[e-mail]>
wrote:

> On 21 November 2014 19:29, Hugo Krawczyk <[e-mail]> wrote:
> > I am glad to hear this too. Please let me know what the sources of
> perceived
> > complexity are.
>
> ​​
> The only items of note were:
>  - the second update to the handshake protection under g^{xs}+g^{xy}.
> We all realized that this was trivially addressed (ekr had a slide at
> the meeting that showed an easy simplification, which should be in the
> meeting materials).
>

​I haven't seen these slides and didn't know about them.
The derivation of keys based on g^{xs} and g^{xy} does NOT use a sum or any
other algebraic combination (although some combinations are secure, most are
not, and identifying the good ones is non-trivial). Anyway, I have left the
details of key derivation unspecified, not because they are not important
for
security (they are!), but because optimizing the derivation depends on the
functionality and properties one wants from the protocol and I wanted to
learn
more about them from these discussions. For the moment just think that a key
derived from the above two quantities will be computed by hashing the two
values
together (with some additional information) and we will model the hash as a
random
oracle in the cryptographic analysis. The actual derivation will be a bit
more
involved for the sake of better provability but not significantly different
from an implementation point of view.

Hugo
​


>  - the delegation scheme itself
>
> I don't think that you can underestimate the costs involved with
> creating an external dependency of any sort - for any project. The
> reliance on PKIX updates could be problematic.  That said, I'm not
> entirely sure that this is as straightforward a win as you suggest.
> If such a flag existed, using it would create the delegation problem
> we were most concerned about.
>
> I'll let others explain more of the thinking behind the delegation
> problem.  I think that it's the only real issue with your proposal
> that you need to worry about.  The performance characteristics are
> probably manageable.
>