Subject: Re: [TLS] Consensus call for keys used in handshake and data messages

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Tue, 14 Jun 2016 11:18:19 +0000

Key reuse often ends up causing problems. IMHO a more sound approach is (2). IMHO it isn't prohibitively expensive either.

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Björn Tackmann
Sent: Tuesday, June 14, 2016 05:23
To: [email-masked]
Subject: Re: [TLS] Consensus call for keys used in handshake and data	messages

+1

> On Jun 14, 2016, at 7:08 AM, Karthikeyan Bhargavan <[email-masked]> wrote:
> 
> I prefer (2)
> 
>> On 13 Jun 2016, at 22:27, Daniel Kahn Gillmor <[email-masked]> wrote:
>> 
>> On Mon 2016-06-13 15:00:03 -0400, Joseph Salowey wrote:
>>> 1. Use the same key for handshake and application traffic (as in the
>>> current draft-13)
>>> 
>>> or
>>> 
>>> 2. Restore a public content type and different keys
>> 
>> Given this choice, i prefer (1).
>> 
>> --dkg
>> 
>> _______________________________________________
>> TLS mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/tls
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Björn Tackmann <[email-masked]>
Date: Tue, 14 Jun 2016 22:45:17 +0200

Just to be clear: the "+1" I sent earlier meant "I agree with Karthik" -- so it means solution (2).

> On Jun 14, 2016, at 1:18 PM, Blumenthal, Uri - 0553 - MITLL <[email-masked]> wrote:
>

---

From: Subodh Iyengar <[email-masked]>
Date: Tue, 14 Jun 2016 21:36:32 +0000

With option (2) would the keys end up being independent anyway? I think we might need to share the sequence number space between the handshake messages and the application data messages to avoid truncation attacks. I might have missed this, but was there a proposal to deal with sequence numbers for option (2). 

I prefer option (1) since it actually offers some privacy guarantees. 

Subodh
________________________________________
From: TLS [[email-masked]] on behalf of Björn Tackmann [[email-masked]]
Sent: Tuesday, June 14, 2016 1:45 PM
To: [email-masked]
Subject: Re: [TLS] Consensus call for keys used in handshake and data   messages

>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=CwIGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=h3Ju9EBS7mHtwg-wAyN7fQ&m=51hv3XazVlAM5-C2nNBPsem5FotA1PNxnRQasbSa0sc&s=wAkXyaR6H8OBIwkPYvnVJClJb5pdbQKYE9gf6wApqB4&e=
>>
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=CwIGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=h3Ju9EBS7mHtwg-wAyN7fQ&m=51hv3XazVlAM5-C2nNBPsem5FotA1PNxnRQasbSa0sc&s=wAkXyaR6H8OBIwkPYvnVJClJb5pdbQKYE9gf6wApqB4&e=
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=CwIGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=h3Ju9EBS7mHtwg-wAyN7fQ&m=51hv3XazVlAM5-C2nNBPsem5FotA1PNxnRQasbSa0sc&s=wAkXyaR6H8OBIwkPYvnVJClJb5pdbQKYE9gf6wApqB4&e=
>
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=CwIGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=h3Ju9EBS7mHtwg-wAyN7fQ&m=51hv3XazVlAM5-C2nNBPsem5FotA1PNxnRQasbSa0sc&s=wAkXyaR6H8OBIwkPYvnVJClJb5pdbQKYE9gf6wApqB4&e=

_______________________________________________
TLS mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=CwIGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=h3Ju9EBS7mHtwg-wAyN7fQ&m=51hv3XazVlAM5-C2nNBPsem5FotA1PNxnRQasbSa0sc&s=wAkXyaR6H8OBIwkPYvnVJClJb5pdbQKYE9gf6wApqB4&e=