[TLS] PRF in 1.3

[Dave Garrett <[e-mail]>]

https://github.com/tlswg/tls13-spec/issues/26

Issue #26 notes complication with the usage of a negotiable PRF. The
current suggestion mentioned was to consider removing PRF
negotiation in favor of SHA-256, calling it "good enough" until the next
protocol version. I agree that this is quite possibly the case, however
I would like to suggest future proofing things a bit. Old versions of TLS
used the strategy of dual hash algorithms "to ensure that
non-catastrophic flaws in one algorithm will not break the overall
protocol" [RFC4346 F.1.5]. TLS 1.1 used MD5+SHA1. For TLS 1.3, I
would like to suggest SHA2-256+SHA3-256 or similar for consideration.
Picking a single combo allows the removal of negotiation, fixing any issues
that causes, provides a simpler spec for this feature, and allows both the
current standard and new SHA functions to be used without having to
rely 100% on either. Adoption rates of new TLS versions are less than
ideal, so future proofing in manners like this that don't add a fantastic
amount of additional complexity seems like an idea worth consideration.


- Dave