Re: [TLS] HKDF

[Hugo Krawczyk <[e-mail]>]

On Wed, Mar 25, 2015 at 11:36 AM, Nikos Mavrogiannopoulos <[e-mail]>
wrote:

> On Wed, 2015-03-25 at 11:21 -0400, Hugo Krawczyk wrote:
>
>
> >         One idea for meaningful reduction of complexity in TLS is if
> >         we could switch to cipher-based KDF.
> > ​That's for the WG to decide but the results we have for the
> > extraction properties of block-cipher based PRFs are much weaker.
>
> I'm not sure whether the WG should even decide on replacing the KDF or
> the main protocols used. That was certainly a non-goal for TLS 1.3 and
>

​
There is an explicit goal of supporting forward secrecy and 0-RTT.
Both require changes to the protocol, in particular the latter requires
introducing server's (semi) static DH keys and an authentication mode that
cannot be solely based on signatures hence necessarily departing from
previous TLS versions. You could add support for the above elements as a
patch/addition to the protocol but even then you would need a review of the
new cryptographic elements and their interaction with the old ones (which
may be trickier to analyze than a well-formed uniform protocol).

Hugo
​


> is a cryptographic decision which is not the expertise of this group.
> For such decisions, and even simpler (see Salsa20, ChaCha cipher
> addition) this working group delegated these decisions to CFRG, and I
> believe this should also be done now if we go the path of replacing
> core TLS structure.
>
> regards,
> Nikos
>
>
>