Re: [TLS] PRF in TLS 1.2

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

Wan-Teh Chang <wtchang@xxxxxxxxxx> writes:

> Hi,
>
> Could someone please post a description of what was decided
> about the PRF in TLS 1.2 in the Montreal WG meeting?
>
> The only documents I can find on this topic are:
>
> - Slide 7 of Eric's presentation
>   (http://www3.ietf.org/proceedings/06jul/slides/tls-1.pdf)
>
> - Eric's TLS WG Summary
>    http://www1.ietf.org/mail-archive/web/tls/current/msg00698.html
>
> But I can't tell from the WG summary what was decided and whether
> the proposal in Slide 7 was accepted.

Here's a summary of what was decided.

1. The default PRF is the TLS 1.1 PRF with a single hash algorithm
   and the entire key used as input to P_hash. 
2. All current cipher suites will use SHA-1 in TLS 1.2.
3. New cipher suites will by default use the TLS 1.1 PRF with whatever
   hash they're using for HMAC.
4. New cipher suites can define a new PRF but it must use the same 
   "API" as the TLS 1.1 PRF.

This is roughly what's in the current I-D, except that I deleted
a crucial paragraph through sloppy editing. It should read 
approximately:

	The PRF is derived from P_hash as:

	    PRF(secret, label, seed) = P_<hash>(secret, label + seed)

	Where <hash> is dependent on the cipher suite. For the
        cipher suites defined in this document it SHALL be SHA-1.
        For future cipher suites it SHALL be the hash used in
        the record HMAC unless otherwise specified in the cipher
        suite description.


> I'd also like to know what new PRFs have been proposed, and who
> the proponents are.

The new PRFs that people seem interested in are:

1. The GOST PRF (draft-chudov-cryptopro-cptls-03.txt)
2. The FIPS 800-56A KDF.

-Ekr




_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls