Re: [TLS] Computation of static secret in anonymous DH

Note: I have updated the WIP (and that's what I sent to Hugo) so it now
contains the
changes the values Hugo describes.

On Fri, Jun 26, 2015 at 12:27 PM, Hugo Krawczyk <hugo@ee.technion.ac.il>
wrote:
>
> 5) Application data uses xES as secret. AFAICT, leads to an attack.
>> Should be master_secret (IIRC, was that way in earlier version)?
>>
>
> Application data uses master_secret: See table before 7.2.1 where
> application keys are derived from MS (should be denoted as master_secret;
> the symbol MS is not used anymore)
>

I intend to change this to "master_secret", but the table got too wide and
I need to figure out how to fix that :)

>
>
>>
>> 6) I think the key table should refer to inputs by their proper
>> names, not e.g. referring to "xES" as "ES" when there is another
>> thing named "ES" (that's confusing even with a note).
>>
>
> The table is correct by referring to xSS and xES.
> These are different values than SS and ES.
> As their name indicates they are extracted versions of the latter, hence
> stronger for use as keys and for extraction seeds.
> 
>

As Hugo indicates, these are now fixed in my working copy.

-Ekr

Hugo
> 
>
>
>> 7) I think there should be helper function defined to do the
>> label zero-padding, instead of it being just a note (just for
>> clarity).
>>
>>
>> -Ilari
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
>
>