Re: [TLS] draft-ietf-tls-exported-authenticator questions

On Thu, Jul 20, 2017 at 12:02 AM, Ilari Liusvaara <ilariliusvaara@welho.com>
wrote:

> While reading/implementing draft-ietf-tls-exported-authenticator I came
> across the following:
>
> 1)
>
> The exporter labels are the opposite way around for handshake
> contexts and finished keys, which makes little sense.
>
> The text seems to imply that the finished key label the client
> uses for sending is "EXPORTER-server authenticator finished key".
>

That is clearly bug. Thanks for commenting.

>
> 2)
>
> In TLS 1.2, even if TLS PRF is not used, the hash function that
> absolutely must exist is called "the hash function to use in the
> Finished message computation" or "the hash function defined for the
> Finished message computation" (and if TLS PRF is used, this hash is
> the same hash function as the one underlying TLS PRF).
>
> TLS 1.3 is less consistent:
>
> - "the Hash algorithm for the handshake" (4.4.4)
> - "KDF hash algorithm" (4.6.1)
> - "the cipher suite hash algorithm" (7.1)
> - "the [...] hash algorithm to be used with HKDF" (B.4)
>
> ... All those apparently refer to one and the same thing.
>
> 3)
>
> What is the Hash() in
>
> "Hash(Handshake Context || Certificate)" and
> "Hash(Handshake Context || Certificate || CertificateVerify)"
>
> ?
>
> I presume it is the same hash as the one took the output length of
> in 2).
>

That is what I interpreted it as.

>
> 4)
>
> What is "the hash function from the handshake" exactly? I presume it
> is the same hash as in 3).
>

It's sad that there is not a hash function determined by negotiation in
TLS. What text would identify it?

>
>
> 5)
>
> Test vectors would be nice (use some deterministic signature, like
> Ed25519)...
>
> I have one set of vectors I dumped from my implementation, but no
> idea if those are correct (for example, I assumed that the handshake
> context and finished labels are the same way around, and the hash for
> points 2 to 4 is the hash function defined for the Finished message
> computation in the TLS connection the authenticator is to be created
> from).
>

There is a site at leftshark.tls13.com that uses this extension. It hasn't
been updated for the latest draft just yet

>
>
>
> -Ilari
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>