Re: [TLS] Working group last call on draft-ietf-tls-extractor-03

["Hugo Krawczyk" <hugo at ee.technion.ac.il>]

Hi,

 

I have a single "objection" to this document, namely, the use of the word "extractor". Let me explain.

 

In the context of key derivation functions the notion of extraction refers to a first phase where one starts with a somewhat weak source of randomness (such as an imperfect RNG, a Diffie-Hellman value, etc) and extracts a first cryptographically strong key K.

 

In a second phase, often called key expansion, one derives multiple keys out of this K using a PRF exactly as the current document specifies. Since master_secret is assumed to already be a cryptographically strong key, then this specification is sound and correct (especially that it includes the essential context information).

 

Thus I would like to see the name "extraction" changed into "expansion" or even "key derivation" to avoid adding confusion in the field.

I would agree that in this application "expansion" may not be the most representative qualifier so maybe the more genric "key derivation" terminology could be used. Yet, personally, I would prefer to keep key derivation for the whole process of extraction and expansion (which includes, for example, the initial creation of master_secret in TLS plus the derivation of further keys),

 

Other names could be possible. I am sure that Eric (or some other people in the list) can come with creative names.

If not, please use key derivation and not key extraction.

Hugo

 

PS: I have written a detailed paper on the functionalities of key extraction and key expansion.

http://www.ee.technion.ac.il/~hugo/kdf/kdf.pdf

The focus of the paper is mainly key extraction since it is the more challenging part from a technical point of view. For those interested in the differentiation between "extraction" and "expansion" reading the introduction may be sufficient. The more theoretically-oriented can find value in the security definitions in the appendix which  capture, for example, the security considerations in this draft including the independence/indistinguishability requirement under different (or even adversarially-chosen) context labels.

 

 

On Thu, Nov 6, 2008 at 1:16 PM, Joseph Salowey (jsalowey) <jsalowey at cisco.com> wrote:

This is a working group last call for review of the
draft-ietf-tls-extractor-03.  The last call will last until December 4,
2008, but it would be most useful if comments were received before the
TLS session at the IETF meeting in Minneapolis on November 20, 2008.
This will allow us to discuss issues in the meeting and resolve them in
a timely fashion.

The document is available here:

http://tools.ietf.org/html/draft-ietf-tls-extractor-03

Thanks,

Joe
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls