Re: [TLS] rm Hello.random w/ (EC)DHE [was OPTLS: Signature-less TLS 1.3]

[Geoffrey Keating <[e-mail]>]

Dan Brown <[e-mail]> writes:

> When using (EC)DHE (inc. OPTLS below), the TLS random nonces
> (ClientHello.random and ServerHello.random) seem redundant (unless
> one re-uses ephemeral secret keys (but then maybe a counter or
> secure time would be almost as good a nonce as a random in this
> case), or perhaps for some other reason I’m missing), and perhaps
> even a point of fragility (e.g. if a common generator for nonces and
> keys is weak, or corrupted). So, does it make sense to remove these
> Hello.randoms, when using (EC)DHE, or to replace them with something
> milder, like Hello.time, Hello.counter, or just Hello.nonce?

The client's nonce is its way of ensuring that the server has
generated a fresh signature on the server's DHE parameters.  However
you could achieve the same thing by having the server sign both its
and the client's DHE parameters, effectively treating them as a nonce.

Another thing the nonces do is ensure that even if the DHE exchange is
controlled by one side, the master secret (and therefore the
connection identification) is still different between different
connections from the client.  To preserve this you would need to
ensure all the DHE parameters are valid.  This is necessary to prevent
a triple handshake style of attack.