Re: [TLS] Thoughts on Hardware Support

[Michael StJohns <[e-mail]>]

On 2/14/2015 2:23 PM, Watson Ladd wrote:
> I think the easiest way is to eliminate the IV derivation entirely,
> and have the record layer send the entire nonce each time. if that's
> too much a waste of bandwidth, then we can specify entirely the
> portion that is in TLS 1.2 derived from the MS. I think this is in
> spirit similar to his proposal, but I don't recall the exact details.

The other way of doing this is to not make IV derivation dependent on 
secret material.  Basically, I suggested that instead to use the same 
KDF function, but with a key of zero and a context of the server and 
client randoms.  That makes IV (or for most AEAD counter based thingies 
- nonce) derivation a straightforward entropy extraction from the two 
generated random numbers.  Alternately, use output of the hash of those 
two concatenated values plus a counter (so you can get more than 1 block 
of extracted data) plus a label (so you can use the same randoms for 
different expansions if you need to).


E.g.


IVDATA = {};
label = { <some number of well known bytes> };
numblocks = CEIL (numBytesNeeded/hashOutputSize);

for (i = 1; i < numblocks; i++) {
     IVDATA = IVDATA || HASH (counter(as uint32 big endian) || label || 
serverRandom || clientRandom);
}

return LTRUNC(IVDATA, numBytesNeeded);


This uses all public data and functions to produce public data (the IV 
or Nonce).


I apologize as I haven't had the cycles to do a pull request and add the 
crypto constructs changes I'm proposing.

Mike