Re: [TLS] New drafts: adding input to the TLS master secret

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> Martin Rex wrote:
> > Marsh Ray wrote:
> >> How big were you planning to make those symmetric keys anyway?
> > 
> > I would prefer to _not_ call anything "key" that is going to
> > travel in the clear.  Personally, I always think of "keys" being
> > secret or even private information.   I would prefer the term
> > "random" or "entropy".
> 
> Sorry if this wasn't clear. I was referring to the actual keys that are
> used for the symmetric algorithm. Negotiating these is one of the main
> goals of the handshake process.
> 
> The point is that it seems like a bit of overkill to require
> more than 448 bits of entropy to generate a key for AES-128.

The useful limit here is probably the size of the MasterSecret (48 bytes)
as Paul indicated.

I share his concern that some TLS peers (those operating in
constrained environments, like small devices, including
handheld devices like PDAs or phones) do not necessarily
have good sources of randomness.

But then, asking them to deplete their pools of randomness
with every SSL handshake and sending that data in the clear
over the network doesn't seem to improve that.


In theory, it would be OK if e.g. such a constrained client
would indicate to the server that it has little randomness
to offer (and itself send an empty extension), and the server
could then take this offer and return additional entropy in
the ServerHello when _NOT_ doing session resumption
(and ignore the extension when doing session resumption),


However, it is not clear to me how this could make up for the lack
of true entropy that goes into the keyexchange performed by the client.


-Martin