Subject: [TLS] PR #699: Simplify traffic key expansion

From: Eric Rescorla <[email-masked]>
Date: Mon, 17 Oct 2016 16:08:33 -0400

Hi folks,

https://github.com/tlswg/tls13-spec/pull/699/files

A while back Steven Valdez pointed out that now that we have the PSK binder
change and dual key ladders, each set of traffic keys is generated from a
different
base secret which has a label folded in [0], so we don't need to have the
"phase" parameter in the traffic key calculation in Section 7.3, which
simplifies things
a bit. Due to an oversight, this didn't make it into the PR, but it seems
straightforward.

Please let me know ASAP if I have missed something here or you otherwise
object.

-Ekr

[0] client_early_traffic_secret, [sender]_handshake_traffic_secret,
[sender]_traffic_secret_N respectively

---

From: Kazuho Oku <[email-masked]>
Date: Fri, 21 Oct 2016 04:52:37 +0900

Hi,

While trying to implement NewSessionTicket, I have noticed that
resumption_psk is derived from resumption_secret.

Is there any need to expand resumption_psk from resumption_secret?

To me, it is unclear why resumption_secret cannot be used directly as
a psk, since the two values have the same lengths and since the secret
is only used for deriving the psk.

Maybe is this something we could also simplify?

2016-10-18 5:08 GMT+09:00 Eric Rescorla <[email-masked]>:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
Kazuho Oku

---

From: Martin Thomson <[email-masked]>
Date: Fri, 21 Oct 2016 10:05:19 +1100

> Maybe is this something we could also simplify?

draft-17 makes a simplification along the lines you suggested.  Note
that this wasn't as easy to get right as you might have imagined for a
bunch of reasons.

---

From: Kazuho Oku <[email-masked]>
Date: Fri, 21 Oct 2016 10:24:02 +0900

Hi Martin,

Thank you for your response.

> that this wasn't as easy to get right as you might have imagined for a

Observing the differences between draft-16 and 17, I understand that
it has become much simpler. In fact, I have decided to skip
implementing the draft-16 style NewSessionTicket and go directly to
implementing draft-17, since the newer draft seems easier to
implement. Thank you for making those adjustments to the draft.

That said, the point I am trying to raise is not something that was
fixed in draft-17. It's something that has become apparent in draft-17
thanks to the simplifications being introduced.

In draft-16, resumption_secret was used for two purposes: generate
resumption_psk and resumption_context. So it made sense to derive
resumption_psk from resumption_secret.

But in draft-17, my understanding is that resumption_context has been
abolished. As the result, generation of resumption_psk has been the
only use of resumption_secret.

That is the reason I thought it might be worthwhile to remove the
following formula in section 4.5.1:

   resumption_psk = HKDF-Expand-Label(resumption_secret,
                                      "resumption psk", "", Hash.Length)

and use resumption_secret as the psk.

Thank you in advance. Please forgive me if I am missing something.

-- 
Kazuho Oku

---

From: Martin Thomson <[email-masked]>
Date: Fri, 21 Oct 2016 12:25:54 +1100

> and use resumption_secret as the psk.

That step does seem redundant, yes.