On Fri, Oct 7, 2016 at 1:08 PM, Eric Rescorla <e...@rtfm.com> wrote: > > > On Fri, Oct 7, 2016 at 10:03 AM, Ilari Liusvaara <ilariliusva...@welho.com > > wrote: > >> On Fri, Oct 07, 2016 at 09:35:40AM -0700, Eric Rescorla wrote: >> > On Fri, Oct 7, 2016 at 8:26 AM, Ilari Liusvaara < >> ilariliusva...@welho.com> >> > wrote: >> > >> > > On Fri, Oct 07, 2016 at 08:01:43AM -0700, Eric Rescorla wrote: >> > > > 4. I've taken a suggestion from David Benjamin to move the >> negotiation >> > > > of the PSK key exchange parameters out of the PSK itself and into a >> > > > separate message. This cleans things up and also lets us drop the >> > > > currently non-useful auth_mode parameter. >> > > >> > > Eeh... From the text, it seems to currently require the kex modes >> > > extension if PSK extension is present. Which seems worse than useless >> > > if the meaning is to get rid of the kex mode parameter from PSK >> > > extension (since you will have the value anyway, but need to dig it >> > > from another extension... Blech). >> > >> > I guess this is a matter of taste, but what convinced me was that: >> > >> > 1. It put all the logic on the server side. >> > 2. It removed the auth mod parameter. >> > >> > Maybe david can say more. >> >> I mean if server is to accept PSK, it must now go fishing for another >> extension, check that it is present and pay attention to values there. >> As opposed to having the data in where it is needed. >> > > This is a reasonable argument (and the reason I stuffed the binder here). > However, David's argument was that this applied to *all* PSKs even new > ones. > > > -Ekr > > > > Also, didn't notice what prevents pathology like this (I presume this >> > > is not allowed): >> > > >> > > (Assume PSK with 0RTT allowed, using AES-128-GCM-SHA256) >> > > >> > > ClientHello[Ciphers=CHACHA20-POLY1305-SHA256, EarlyDataIndication] >> ---> >> > > [0-RTT data, encrypted using AES-128-GCM-SHA256] >> > > <-- ServerHello[Cipher=CHACHA20-POLY1305-SHA256] >> > > <-- EncryptedExtensions[EarlyDataIndication] >> > > >> > > Note the record protection algorithm mismatch. >> > > >> > >> > Yes, this is forbidden by the combination of: >> > >> > "The parameters for the 0-RTT data (symmetric cipher suite, >> > ALPN, etc.) are the same as those which were negotiated in the >> connection >> > which established the PSK. The PSK used to encrypt the early data >> > MUST be the first PSK listed in the client's "pre_shared_key" >> extension." >> > (though I think I just recently added cipher suite). >> > >> > and: >> > "Any ticket MUST only be resumed with a cipher suite that is identical >> > to that negotiated connection where the ticket was established." >> >> If 0-RTT is used with manually provisioned PSKs (might not be allowed >> currently, but might be allowed soon), does that still hold? >> >> Also, I think it is problematic that externally provisioned PSKs can >> be used with any protection with given prf-hash, while NST-provisioned >> PSKs can only be used with one protection and prf-hash. >> >> 0-RTT requirements are separate matter, since those would apply to all. >> >> The original purpose of resumption-as-PSK was AFAIK to unify the two >> mechanisms to simplify things. Therefore those two should be as similar >> as possible. >> >> > >> > Also, to straightforwardly prove that collision resistance of HKDF and >> > > HMAC (as used) follows from collision resistance of the underlying >> hash >> > > function, yon need to take the output to be at least the hash output >> > > size. As otherwise it is not guaranteed that any collision in HKDF or >> > > HMAC can be reduced into collision of the underlying hash. >> > > >> > >> > Right. I have some text here but please feel free to suggest more. >> >> Yes, but the text says 256 bit output is enough. One isn't guaranteed >> to be able to reduce such collision to collision of >256 bit hash. >> >> (In fact, if the hash is e.g. 384 bit, 256-bit collisions are extremely >> unlikely to reduce). >> > > Right. I can update. >
I think that allowing truncation (e.g. for SHA-512) with at least 256-bit output should be fine too without forcing implementations to work with, say, 512-bit keys. While I agree that we don't have generic reductions from collision resistance of a hash function to its truncations, such (long enough) truncations are believed to inherit collision resistance. For example, SHA-512 is "officially" allowed to be truncated and it is the way SHA-384 is defined. Also, a collision on a 256-bit truncated output would be a MAJOR weakness for any hash function, in particular "breaking" the treatment of the function as a random oracle (such weakness must lead to abandoning that hash function). What do cryptanalysts think? Hugo > > -Ekr > > >> >> >> >> -Ilari >> > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > >
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
