Subject: [TLS] A small detail in HMAC key generation for Finished message

From: Christian Huitema <[email-masked]>
Date: Wed, 23 Dec 2015 22:19:10 +0000

In the current 1.3 draft, section 6.3.4.3 specifies the content of the Finished message. It contains this specification for key computation:

client_finished_key =
    HKDF-Expand-Label(BaseKey, "client finished", "", L)

server_finished_key =
    HKDF-Expand-Label(BaseKey, "server finished", "", L)

I wonder what the zero length string actually means. Is it a null-terminated string that would encode in binary as a one octet byte string of value 0, or an empty string that would encode in binary as a zero length string?

There is one example of encoding a string in section 4.8.1, and the binary representation shows the encoding of the final null byte. Is that a common assumption?

Similarly, in the HKDF-Expand-Label, do we assume a final null byte for the "label"?

-- Christian Huitema

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 23 Dec 2015 15:04:55 -0800

On Wed, Dec 23, 2015 at 2:19 PM, Christian Huitema <[email-masked]>
wrote:

> In the current 1.3 draft, section 6.3.4.3 specifies the content of the
> Finished message. It contains this specification for key computation:
>
> client_finished_key =
> I wonder what the zero length string actually means. Is it a
> null-terminated string that would encode in binary as a one octet byte
> string of value 0, or an empty string that would encode in binary as a zero
> length string?
>

I see what you mean about the ambiguity here. What I meant was 0 bytes
(i.e., no trailing '\0').

There is one example of encoding a string in section 4.8.1, and the binary
> representation shows the encoding of the final null byte. Is that a common
> assumption?
>

No.

> Similarly, in the HKDF-Expand-Label, do we assume a final null byte for

No. I wonder if we should instead add the '\0' explicitly in the 4.8.1 for
maximal clarity.
-Ekr

> -- Christian Huitema
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Christian Huitema <[email-masked]>
Date: Thu, 24 Dec 2015 01:04:59 +0000

On Wednesday, December 23, 2015 3:05 PM, Eric Rescorla wrote:
>> I wonder what the zero length string actually means. Is it a null-terminated string 
>> that would encode in binary as a one octet byte string of value 0, or an empty 
>> string that would encode in binary as a zero length string?
>

OK, makes sense.

>> There is one example of encoding a string in section 4.8.1, and the binary representation
>> shows the encoding of the final null byte. Is that a common assumption?
>
> No.
>
> No. I wonder if we should instead add the '\0' explicitly in the 4.8.1 for maximal clarity.

Either that, or just remove the trailing 00 from the binary description.

-- Christian Huitema

---

From: Michael StJohns <[email-masked]>
Date: Fri, 25 Dec 2015 11:47:12 -0500

> Either that, or just remove the trailing 00 from the binary description.

Or even better.  Express the label as a specific sequence of octets as 
the normative form for each and every label.   That then avoids 
questions of the form "C String"?  "Ascii"?, "Wide characters"?, etc.

Mike