Skip to content

Commit

Permalink
Update to Exporter
Browse files Browse the repository at this point in the history
  • Loading branch information
tireddy2 authored Oct 18, 2024
1 parent 81c0d51 commit 1c3dc52
Showing 1 changed file with 12 additions and 0 deletions.
12 changes: 12 additions & 0 deletions draft-ietf-tls-extended-key-update.md
Original file line number Diff line number Diff line change
Expand Up @@ -496,6 +496,18 @@ SSLKEYLOGFILE was not used for other secrets in the handshake.
Note that each successful Extended Key Update invalidates all previous SSLKEYLOGFILE secrets including
past iterations of `CLIENT_TRAFFIC_SECRET_` and `SERVER_TRAFFIC_SECRET_`.

# Exporter

Protocols like DTLS-SRTP and DTLS-over-SCTP utilize TLS or DTLS for key establishment but repurpose
some of the keying material for their own purpose. These protocols use the TLS exporter defined in
Section 7.5 of {{I-D.ietf-tls-rfc8446bis}}.

Once the Extended Key Update mechanism is complete, such protocols would need to use the newly
derived key to generate Exported Keying Material (EKM) to protect packets. The "sk" derived in the
{{key_update}} will be used as the "Secret" in the exporter function, defined in
Section 7.5 of {{I-D.ietf-tls-rfc8446bis}}, to generate EKM, ensuring that the exported keying material is
aligned with the updated security context.

# Security Considerations

This entire document is about security.
Expand Down

0 comments on commit 1c3dc52

Please sign in to comment.