Re: [TLS] New drafts: adding input to the TLS master secret

[Eric Rescorla <[e-mail]>]

At Mon, 08 Feb 2010 12:44:25 -0800,
Eric Rescorla wrote:
> 
> At Mon, 8 Feb 2010 14:29:12 -0500 (EST),
> Dean Anderson wrote:
> > On Sat, 6 Feb 2010, Eric Rescorla wrote:
> > The primary purpose (unique master_secrets) of these random numbers is
> > unimportant.  If they are not truly random, they expose the
> > pseudo-random sequence generator sequence. This is an unintended (but
> > significant) consequence.
> 
> With any reasonable PRNG this is not a security concern.
> 
> > > Well, this isn't true for the server half of the static RSA cipher
> > > suites, since the server doesn't contribute to the PMS at all.
> > 
> > True, the server random doesn't expose the client's pre_master_secret in
> > that _particular_ calculation.  But the server IS still exposing its
> > (possibly dependent) random numbers. If you collect enough of these
> > through snooping, you can predict its pre_master_secret for connections
> > orginating from that machine.
> 
> This is true only in an information theoretic sense. It is not
> correct with any reasonable and reasonably seeded CSPRNG.

And by correct I mean "it's not computationally feasible".

-Ekr