Re: [TLS] Initial draft of DH-based key exchange

[Ilari Liusvaara <[e-mail]>]

On Fri, Mar 27, 2015 at 07:51:54PM -0400, Hugo Krawczyk wrote:
> The theme of simplification applies to your concerns below too.
> The simpler the protocol the closer it stays to its underlying
> cryptographic core hence the closer it stays to the cryptographic semantics.
> Actually, the issue of simplifying semantics is of utmost importance.
> 
> For example, the hierarchical key derivation scheme in TLS 1.3/OPTLS bind
> terminal keys (those used for data protection either inside the handshake
> or output for record protection) to a unique context encompassing a label
> defining the key's functionality and information that ties the key to
> particular handshake session (including nonces, negotiated parameters,
> identities, etc.). That defines the semantics and provenance of keys which
> should be the only thing that consumers of the TLS handshake need to know
> about these keys.
> 
> One thing to double check when specifying the handshake protocol is that
> context and intended semantics match indeed.

I consider it important to:

1) Ensure that there are point where entiere context is captured.

E.g. Handshake master secret not being in every key derivation chain
or not including transcript so far makes security analysis quite a bit
harder.

This is from attackers being able to penetrate deeper into structure
in less well defined ways.

See the session_hash I-D for example of things potentially going
wrong due lack of such point ("attacks [...] are not yet known").

To be fair to session_hash, TLS 1.2 structure is the problem. But
TLS 1.3 has very natural point of doing so: The place where handshake
goes encrypted and associated handshake MS.

2) Capture entiere relevant context for anything potentially used for
   authentication.

TLS-Extractor MS needs to incorporate EncryptedExtensions in case
there is some extension affecting TLS-Extractor.

3) Mix in input keys at the earliest available stage.

The PSK and static-DH inputs are not the same!

4) Keep separate keys separate

Using application MS as exporter MS seems like a bad idea.


-Ilari