Subject: [TLS] Short Authentication String for TLS/DTLS Draft

From: Eric Rescorla <[email-masked]>
Date: Fri, 14 Feb 2014 15:28:36 -0800

RTCWEB WG members may be interested in the following draft:

http://tools.ietf.org/html/draft-miers-tls-sas-00

This draft specifies a Short Authentication String feature for
TLS and DTLS which would allow a pair of communicating
to compare SAS values computed from the TLS/DTLS
handshake in order to detect active attack.

-Ekr

---

From: Adam Langley <[email-masked]>
Date: Fri, 14 Feb 2014 18:41:18 -0500

> handshake in order to detect active attack.

I think the draft should discuss why a channel binding doesn't work.
It's hinted at in the introduction but it's a subtle point because
they are otherwise very similar.

Given that I see M. Green as an author, should I assume that the
requirement for 64 bytes of randomness for a /short/ authentication
string is to ensure that users of Dual_EC DRBG have no problems
leaking the necessary entropy to a passive observer? :)

Cheers

AGL

---

From: Yoav Nir <[email-masked]>
Date: Sun, 16 Feb 2014 16:04:37 +0000

> they are otherwise very similar.

Adam reads deeper between the lines that I do, but yes, this seems like a third way of generating a session-specific shared key, after channel bindings and TLS extractors. So stating why neither will do seems like a good idea.

I see that the key generated in this solution is not tied to the session keying material, and is not secret. Secrecy may not be needed here, but is the lack of secrecy a requirement?

Yoav