Re: [TLS] New drafts: adding input to the TLS master secret

[Marsh Ray <[e-mail]>]

Paul Hoffman wrote:
> 
> This proposed protocol change is only relevant to scenarios where
> there is a cryptographic reason to mix inherently non-sensitive data
> passed before the change_cipher_spec message into the master secret.

I don't get it. (Sorry I am a little dense sometimes)

You said the data is "not sensitive" and it is sent in plain text. So an
attacker has it as soon as the endpoints do.

What does this accomplish over just hashing your extra data into the 28
byte random field? (which would not require a new protocol structure)

224 bits of from each endpoint ... is 448 bits really not enough entropy
somehow? 448 bits ought to be enough for anybody :-)

It looks to me (but IANAC) like the PRF maxes out at 672 bits of entropy
doing key block expansion (master_secret[48]*8 + 128md5 + 160sha), so
you can only effectively add 224 bits (only 50% more) from any source.

How big were you planning to make those symmetric keys anyway?

- Marsh