Re: [TLS] Computation of static secret in anonymous DH

[Nico Williams <[e-mail]>]

On Fri, Jun 26, 2015 at 10:08:55AM -0700, Eric Rescorla wrote:
> On Fri, Jun 26, 2015 at 9:54 AM, Ilari Liusvaara <
> [e-mail]> wrote:
> > On Fri, Jun 26, 2015 at 05:55:21AM -0700, Eric Rescorla wrote:
> > > On Fri, Jun 26, 2015 at 1:50 AM, Ilari Liusvaara <
> > > [e-mail]> wrote:
> > > > 4) Why is finished independent of ES (IIRC, it did depend on it
> > > > in earlier version)?
> > >
> > > i'm going to refer these to Hugo, as they were his suggestion.
> >
> > Also, TLS 1.2 had tls-unique also be secret (but one would have to
> > really misuse it for that to matter). With finished just depending on
> > SS, secrecy might fail.
> 
> As I understand it, there are cryptographic logic reasons for this (again,
> I'll defer to Hugo here). Maybe we should just define a new value
> for TLS-Unique based on the exporter secrets?

tls-unique depends on the Finished message strongly binding the entire
transcript up to that point.  I find this elegant (despite the
resumption problem, which anyways, should be fixed by the session hash)
and easy to understand and analyze.

If the Finished message no longer has this property in 1.3 then that's a
problem for tls-unique, and we'd have to fix one or the other.  Surely
1.3 will have some handshake message that binds the transcript, and why
that wouldn't be the Finished message is beyond me (but I am missing a
lot of the 1.3 context, so please forgive and inform me).

It would be better though to move the responsibility for defining
tls-unique to the TLS 1.3 spec even if tls-unique remains unchanged.
That way 1.3 and/or future versions of TLS can specify different
constructions of tls-unique.

Nico
--