Re: [TLS] Resumption Contexts and 0-RTT Finished

[Ilari Liusvaara <[e-mail]>]

On Wed, Jul 20, 2016 at 01:42:58AM -0400, Hugo Krawczyk wrote:
> Without taking a position on the implementation issues, I am in favor of
> Option A with a dedicated context value (and an explicit name "PSK
> Context") as this makes clear the function of this value. Relying in
> Finished makes it more fragile and open to be dropped in the future when
> its binding role is "forgotten" or when deriving some other protocol or
> variant.

Furthermore, I think that there are only two ways to do the kind of
binding required that aren't fatally flawed (as far as I know) in some
way.

One is ADL's "Option A", and the other is implicit variant of "Option B"
I came up with. Both are ugly.

I think ADL's "Option A" is easier to implement (no need to mess with
Finished generation).


I also think that the 0-RTT Finished message should be removed (as
suggested before by one of the "crypto guys", I forgot who). It
is major implementation problem, and doesn't seem to even provode any
security.


> Also, I insist on the need to remark about the need for collision
> resistance of any value with a binding functionality. If this value is
> produced with HKDF (or HMAC as in he case of Finished) the need for
> collision resistance is not explicit and can lead to truncation (which is
> perfectly fine when just deriving keys or when used with a regular PRF
> functionality).

The properties that HKDF and HMAC actually provodes here:

If the base hash is CR and has output length at most blocklength,
then...

- HMAC is CR w.r.t. its message input.
- If the HMAC key is of constant length, the HMAC is CR w.r.t. its
  key.
- HKDF-Extract is CR w.r.t. its key input.
- If the salt is of constant length, HKDF-Extract is CR w.r.t. its
  salt.
- If length is at least one hash output, HKDF-Expand-Label is CR
  w.r.t. its label.
- If length is at least one hash output, HKDF-Expand-Label is CR
  w.r.t. its hashvalue.
- If length is at least one hash output and secret is of constant
  length, HKDF-Expand-Label is CR w.r.t. its secret.

These all can be shown by supposing an counterexample, and showing
that it inevitably follows that the base hash is both CR and not CR
at the same time, which is not possible.

(Conviniently, all length constraints are currently always met).


> Actually, I would suggest that for any such value, we add "collision
> resistance" to the label for that derivation - this would apply to
> resumption/PSK context and to Exporter key (and possibly others)

<bikeshed>
I suggest appending ", collision resistant".
</bikeshed>

(E.g. "TLS 1.3, exporter master secret, collision resistant", after
fully expanding the label)


-Ilari