Subject: RE: [TLS] PRF in TLS 1.2

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 28 Sep 2006 12:46:43 -0400

>> No it isn't, because each half of the secret by itself has sufficient
>> entropy, as far as we understand the security arguments for all of
the
>> currently defined ciphersuites.
>
>I haven't seen a convincing argument for this when the PMS
>is a Diffie-Hellman ZZ.

There can be no convincing argument, because that statement isn't true!

It would be true for DH over Elliptic Curve.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: David Hopwood <[email-masked]>
Date: Thu, 28 Sep 2006 18:36:35 +0100

Blumenthal, Uri wrote:
>>>the currently defined ciphersuites.
>>

It is true, under the Decisional DH assumption (see the first paper I cited
in my other reply). What makes you say that it isn't?

> It would be true for DH over Elliptic Curve.

The most recent results I know of for ECDH are given in
<http://eprint.iacr.org/2005/324>; if anything the conclusions are
slightly weaker than for DH.

-- 
David Hopwood <[email-masked]>