MIME-Version: 1.0
In-Reply-To: <CAF8qwaB8W20pwUk2bFo5854ZXmZ+mmprn4esc=L0v2r84XwdrA@mail.gmail.com>
References: <CAF8qwaB8W20pwUk2bFo5854ZXmZ+mmprn4esc=L0v2r84XwdrA@mail.gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Fri, 15 Jul 2016 12:59:13 +0100
Message-ID: <CABcZeBMwpoijh7bJiWQn0T+p78ie+=O_R=+mY8h3=U0QuQ1vrA@mail.gmail.com>
To: David Benjamin <davidben@chromium.org>
Content-Type: multipart/alternative; boundary=94eb2c14710a35a7330537ab5b67
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/z5Ufkh2r6QNLkwyztoMeh2IxlVk>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Why is resumption_context hashed?
Precedence: list

--94eb2c14710a35a7330537ab5b67
Content-Type: text/plain; charset=UTF-8

On Fri, Jul 15, 2016 at 11:39 AM, David Benjamin <davidben@chromium.org>
wrote:

> Every time resumption_context is used, it's fed into the PRF hash.
> Handshake Context gets hashed since that actually expands to the full
> concatenation and we want to be able to maintain a rolling hash.
> But resumption_context is always a short value and is already the size of
> the PRF hash. (If not resuming, it is the zero key, which is sized
> appropriately. If resuming, it is the size of the PRF hash of the original
> connection. But we require that resumptions use the same PRF, so that too
> will be the right size.)
>
> Was there some other reason we needed to hash it, or is a guarantee of
> constant size sufficient to use it directly? If it still needs to be
> hashed, it seems we ought to redefine resumption_context to be
> Hash(HKDF-Expand-Label(...)) instead, mostly as a hint to implementors that
> one may as well store the final value in the ticket.
>

I didn't have a good reason. It was just giving me the heebie jeebies
(technical term) to append something that wasn't hashed to something that
was.

-Ekr


>
> David
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>

--94eb2c14710a35a7330537ab5b67
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On F=
ri, Jul 15, 2016 at 11:39 AM, David Benjamin <span dir=3D"ltr">&lt;<a href=
=3D"mailto:davidben@chromium.org" target=3D"_blank">davidben@chromium.org</=
a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0=
 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">Eve=
ry time resumption_context is used, it&#39;s fed into the PRF hash. Handsha=
ke Context gets hashed since that actually expands to the full concatenatio=
n and we want to be able to maintain a rolling hash. But=C2=A0resumption_co=
ntext is always a short value and is already the size of the PRF hash. (If =
not resuming, it is the zero key, which is sized appropriately. If resuming=
, it is the size of the PRF hash of the original connection.=C2=A0<span sty=
le=3D"line-height:1.5">But we require that resumptions use the same PRF, so=
 that too will be the right size.)</span><div><br></div><div>Was there some=
 other reason we needed to hash it, or is a guarantee of constant size suff=
icient to use it directly? If it still needs to be hashed, it seems we ough=
t to redefine resumption_context to be Hash(HKDF-Expand-Label(...)) instead=
, mostly as a hint to implementors that one may as well store the final val=
ue in the ticket.</div></div></blockquote><div><br></div><div>I didn&#39;t =
have a good reason. It was just giving me the heebie jeebies (technical ter=
m) to append something that wasn&#39;t hashed to something that was.</div><=
div><br></div><div>-Ekr</div><div><br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">=
<div dir=3D"ltr"><div><span class=3D"HOEnZb"><font color=3D"#888888"><br><d=
iv><div><div><br></div><div>David</div></div></div></font></span></div></di=
v>
<br>_______________________________________________<br>
TLS mailing list<br>
<a href=3D"mailto:TLS@ietf.org">TLS@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/tls" rel=3D"noreferrer" ta=
rget=3D"_blank">https://www.ietf.org/mailman/listinfo/tls</a><br>
<br></blockquote></div><br></div></div>

--94eb2c14710a35a7330537ab5b67--