Re: [TLS] rm Hello.random w/ (EC)DHE [was OPTLS: Signature-less TLS 1.3]

Geoffrey Keating <> Mon, 10 November 2014 19:06 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id ADB141A9146 for <>; Mon, 10 Nov 2014 11:06:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.498
X-Spam-Status: No, score=0.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_54=0.6, J_CHICKENPOX_55=0.6, J_CHICKENPOX_56=0.6, J_CHICKENPOX_57=0.6, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id oHrnmNqvatnl for <>; Mon, 10 Nov 2014 11:06:12 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 0D5C91A9172 for <>; Mon, 10 Nov 2014 11:05:53 -0800 (PST)
Received: by (Postfix, from userid 501) id A790733D1A3; Mon, 10 Nov 2014 19:05:51 +0000 (UTC)
Sender: geoffk@localhost.localdomain
To: Dan Brown <>
References: <>
From: Geoffrey Keating <>
Date: Mon, 10 Nov 2014 11:05:51 -0800
In-Reply-To: <>
Message-ID: <m2vbmmri40.fsf@localhost.localdomain>
Lines: 23
User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.4
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Cc: "''" <>, "''" <>
Subject: Re: [TLS] rm Hello.random w/ (EC)DHE [was OPTLS: Signature-less TLS 1.3]
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 10 Nov 2014 19:06:13 -0000

Dan Brown <> writes:

> When using (EC)DHE (inc. OPTLS below), the TLS random nonces
> (ClientHello.random and ServerHello.random) seem redundant (unless
> one re-uses ephemeral secret keys (but then maybe a counter or
> secure time would be almost as good a nonce as a random in this
> case), or perhaps for some other reason I’m missing), and perhaps
> even a point of fragility (e.g. if a common generator for nonces and
> keys is weak, or corrupted). So, does it make sense to remove these
> Hello.randoms, when using (EC)DHE, or to replace them with something
> milder, like Hello.time, Hello.counter, or just Hello.nonce?

The client's nonce is its way of ensuring that the server has
generated a fresh signature on the server's DHE parameters.  However
you could achieve the same thing by having the server sign both its
and the client's DHE parameters, effectively treating them as a nonce.

Another thing the nonces do is ensure that even if the DHE exchange is
controlled by one side, the master secret (and therefore the
connection identification) is still different between different
connections from the client.  To preserve this you would need to
ensure all the DHE parameters are valid.  This is necessary to prevent
a triple handshake style of attack.