Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to "Updating Traffic Secrets Section" #6

Merged
merged 2 commits into from
Jul 8, 2024
+12 −1
Merged

Update to "Updating Traffic Secrets Section" #6

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
13c9f16
Update to Updating Traffic Secrets Section
tireddy2 Jul 7, 2024
cba9433
Add files via upload
tireddy2 Jul 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion draft-tschofenig-tls-extended-key-update.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,12 @@ informative:
title: Transport Layer Security (TLS) Extensions
target: https://www.iana.org/assignments/tls-extensiontype-values
date: November 2023
CDM23:
author:
org: ACM
title: "Keeping Up with the KEMs: Stronger Security Notions for KEMs and automated analysis of KEM-based protocols"
target: https://eprint.iacr.org/2023/1933.pdf
date: November 2023

--- abstract

Expand Down Expand Up @@ -331,7 +337,9 @@ of application_traffic_secret is motivated by the desire to include
* the old traffic secret as well as a secret derived from the DH
exchange or from the hybrid key exchange,
* the concatenation of the ExtendedKeyUpdateRequest and the
ExtendedKeyUpdateResponse messages, which contain the key shares, and
ExtendedKeyUpdateResponse messages, which contain the key shares, binding
the encapsulated shared secret ciphertext to IKM in case of hybrid key
exchange, providing MAL-BIND-K-CT security (see {{CDM23}}), and
* a new label string to distinguish it from the application traffic
secret computation defined in {{I-D.ietf-tls-rfc8446bis}} for use with
the regular KeyUpdate.
Expand All @@ -345,6 +353,9 @@ application_traffic_secret_N+1 =
Hash.length)
~~~

The traffic keys are re-derived from the client_/server_application_traffic_secret_N+1
as described in Section 7.3 of {{I-D.ietf-tls-rfc8446bis}}.

Once client_/server_application_traffic_secret_N+1 and its associated
traffic keys have been computed, implementations SHOULD delete
client_/server_application_traffic_secret_N and its associated
Expand Down
Loading