Re: [TLS] IV Generation was: Clarifications and questions: TLS1.3 - Static RSA and AEAD

[Michael StJohns <[e-mail]>]

On 5/27/2014 4:46 PM, Martin Rex wrote:
> Michael StJohns wrote:
>> 2) ----------------------------------
>>
>> As a specific comment on how the master secret is used:
>>
>> The general rule is that the same key shouldn't be used for multiple
>> things.  In this case the master secret is used (ignoring for a moment
>> that the functions are all iterations of the PRF):
>>
>>    * with a Key Derivation Function to derive key material
>>    * with a MAC function to sign the finished messages
>>    * with a keyed pseudo random number generator to derive the IV's.
>>
>> By my count that's two too many.  The fact that the KDF and PRNG steps
>> are part of the same process is even more problematic.
>>
>> There's literature on this - but an easy reference is section 5.2 of
>> NIST's SP800-57 part 1 rev 3 -
>> http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-57-Part%203-Rev.1:
>>
>>> 5.2 Key Usage
>>> In general, a single key should be used for only one purpose (e.g.,
>>> encryption, authentication, key wrapping, random number generation,
>>> or digital signatures). There are several reasons for this:
>
> I believe you're misinterpreting the concept of the TLS master secret.
>
> The TLS master secret is *NOT* a key.  It is more like the entropy pool
> (internal state) of a DBRG (Deterministic Random Bit Generators).



Um.... taken one way you could call any key an entropy pool.  I think 
you're misinterpreting the characteristics of a key.

So, no.

Stealing from the definition of "Cryptographic Key" in SP800-57 part 1 
rev 3:

> A parameter used in conjunction with a cryptographic algorithm that
> determines its operation in such a way that an entity with knowledge of
> the key can reproduce or reverse the operation, while an entity without
> knowledge of the key cannot.

Continuing, the master secret *is* used explicitly as a MAC key 
(finished message) and as a master key for a KDF (key expansion).

Seriously though - no.   Basically if you share it, it's no longer an 
entropy pool, but a key.  And as I've suggested several times before, 
its unclear that the function that generates the IVs needs to to be 
keyed, or do anything except expand the entropy available from 
client_random and server_random to an appropriate length and with a 
particular set of mix-in's.

Mike


>
>
> -Martin