Re: [TLS] New drafts: adding input to the TLS master secret

[Eric Rescorla <[e-mail]>]

At Tue, 02 Feb 2010 19:50:42 -0600,
Marsh Ray wrote:
> 
> Paul Hoffman wrote:
> > 
> > This proposed protocol change is only relevant to scenarios where
> > there is a cryptographic reason to mix inherently non-sensitive data
> > passed before the change_cipher_spec message into the master secret.
> 
> I don't get it. (Sorry I am a little dense sometimes)
> 
> You said the data is "not sensitive" and it is sent in plain text. So an
> attacker has it as soon as the endpoints do.
> 
> What does this accomplish over just hashing your extra data into the 28
> byte random field? (which would not require a new protocol structure)
> 
> 224 bits of from each endpoint ... is 448 bits really not enough entropy
> somehow? 448 bits ought to be enough for anybody :-)

Moreover, the the purpose of the random values is *not* to add extra
cryptographic strength, since they're not secret. Rather, it's to
ensure uniqueness of the handshake master secret even if the PMS is
repeated. However, the bound here is just the collision bound for the
random values, which doesn't require anything like 224 bits.

I'm not really against this extension, but I'm not aware of any
coherent security argument for it.

-Ekr