Re: [TLS] confirming the room’s consensus: adopt HKDF PRF for TLS 1.3

[Michael StJohns <[e-mail]>]

On 4/26/2015 4:20 PM, Hugo Krawczyk wrote:
>
>
>     All calls to HKDF *should* use a non-empty label and context
>     field, but that's tied more to the specific use than anything else.
>
>
> ​ Agreed. All calls to HKDF that produce cryptographic keys for use in 
> the protocol MUST use a non-empty label and context field and that's 
> what we do.

Some clarification here:


For HKDF as a generic function, I meant "SHOULD" in its normal meaning.  
Implementations of HKDF can permit a null label and context field and 
will get what they expect from that.

For HKDF as a the KDF for TLS, TLS will assign labels and associate 
contexts for specific usages and those are going to be non-null.

Mike