Re: [TLS] Premaster/Master convention

I can't go into details around it at this time.  Suffice to say, we definitely do rely on the two being split.

-----Original Message-----
From: Michael StJohns [mailto:msj@nthpermutation.com] 
Sent: Wednesday, July 30, 2014 11:46 AM
To: Gero, Charlie; tls@ietf.org
Subject: Re: [TLS] Premaster/Master convention

On 7/30/2014 11:02 AM, Gero, Charlie wrote:
> We have a number of technologies at Akamai that utilize the fact that the PMS is split from the MS and that MS is produced in conjunction with the randoms.  It allows us to do splitting between machines that have keys and those that don't (machines in safe locales and those which are simply terminators).  I don't think we could use the same methods we use today without that sub step.  It would make it very difficult for Akamai to adopt 1.3.

So you send the master secret from the handshaker machine out to several other machines which then do what with it?  Couldn't you send the traffic keys instead?

I'm not sure I understand the constraints you're working under. Could you expand on that?

Thanks - Mike

>
> -----Original Message-----
> From: Michael StJohns [mailto:msj@nthpermutation.com]
> Sent: Wednesday, July 30, 2014 10:57 AM
> To: tls@ietf.org
> Subject: [TLS] Premaster/Master convention
>
> Given that TLS1.3 only does KeyAgreement, is there still any reason for the premaster -> master_secret derivation step?  We do (KA)->premaster
> and then premaster -> master and then master->(session keys).   We could
> probably do (KA)->master->(session keys) where the master secret is now the KA shared secret rather than premaster.
>
> 1) Is there any security reason for retaining the extra step given there is no longer a KeyTransport mechanism in TLS1.3?
> 2) Are there other *good* - non-security - reasons for retaining the extra step?
>
> Mike
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>