Re: [TLS] PRF in 1.3

[[e-mail] (Martin Rex)]

Dave Garrett wrote:
>
> https://github.com/tlswg/tls13-spec/issues/26
> 
> Issue #26 notes complication with the usage of a negotiable PRF. The
> current suggestion mentioned was to consider removing PRF
> negotiation in favor of SHA-256, calling it "good enough" until the next
> protocol version.

The PRF was already negotiable (i.e. depending on the cipher suite)
in TLSv1.0.  While this isn't spelled out in the TLSv1.0 spec, it
is clear from the TLS WG discussions about TLSv1.0 and there is
nothing in the TLSv1.0 spec that precludes it.

There are implementations in active use with GOST-based TLS cipher suites,
which replace the TLS PRF (and the hashes used within), and this is
used with TLSv1.0.  The I-D describing the cipher suites has never been
completed, though:
   http://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04

and there also exist no code point assignments in the TLS registry,
so using this with TLSv1.2 is not possible (only TLSv1.0 and TLSv1.1).

The GOST signature algorithms described in that I-D have also been
superseded by more recent ones, but there currently is no description
for those either.

Our TLS (v1.0) implementation contains a plugin interface which can
replace the TLS PRF, just like Microsoft Windows XP(!) has such an
interface.  AFAIK, OpenSSL 1.0.0 also had support for GOST ciphersuites
from the above draft.


-Martin