Subject: [TLS] PR#346: Individual traffic key generation

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Nov 2015 17:25:45 -0800

https://github.com/tlswg/tls13-spec/pull/346

As discussed in Seattle and Yokohama, I've broken out the traffic key
generation
into individual values. This makes life somewhat easier for those dealing
the
cryptographic modules, because some of this data needs to be public and some
of it needs to be secret.

This general change already had consensus, so I plan to merge it on
Wednesday
modulo major objections. Please advise here or on Github if you find any
errors
or you violently object.

-Ekr

---

From: Martin Thomson <[email-masked]>
Date: Mon, 16 Nov 2015 19:01:44 -0800

I have to ask why the continued insistence on calling the thing that
forms part of the nonce an "IV".  I find it to be misleading.

Also, it might be worth noting that the string "early data key
expansion, server write " is never needed.

On 16 November 2015 at 17:25, Eric Rescorla <[email-masked]> wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Nov 2015 19:52:22 -0800

> forms part of the nonce an "IV".  I find it to be misleading.

This is the historical terminology that TLS has used.

> expansion, server write " is never needed.

Yes, that's fair.

-Ekr

---

From: Martin Thomson <[email-masked]>
Date: Mon, 16 Nov 2015 22:29:54 -0800

> This is the historical terminology that TLS has used.

It was actually accurate when we were using CBC modes, but now it's
just confusing.

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 17 Nov 2015 06:32:31 -0800

> It was actually accurate when we were using CBC modes, but now it's

It wasn't accurate in TLS 1.1 or later.

-Ekr