Re: [TLS] PRF in TLS 1.2

Eric Rescorla wrote:
>
> The new PRFs that people seem interested in are:
> 
> 1. The GOST PRF (draft-chudov-cryptopro-cptls-03.txt)

The GOST PRF, PRF_GOSTR3411, is defined in RFC 4357 as

   PRF_GOSTR3411(secret,label,seed) = P_GOSTR3411 (secret,label|seed)

   where '|' stands for concatenation.

It is actually an instance of the default TLS 1.2 PRF,
with <hash> = the GOST R 34.11-94 hash function.  This
isn't a coincidence, is it?

> 2. The FIPS 800-56A KDF.

Appendix A, Item 8 of NIST SP 800-56A says this KDF
comes from ANS X9.42 and X9.63, but NIST made some minor
(and perhaps subtle) changes (e.g., the order of the counter
and secret is reversed).  I don't know if this KDF is
used in any other standard or protocol.

Perhaps we should ask NIST if P_SHA-1, P_SHA-256, and
P_SHA-384 are allowed in TLS in FIPS mode.

Wan-Teh

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls