Subject: Re: [TLS] Simplifying the proof

From: Nigel Smart <[email-masked]>
Date: Sat, 23 Aug 2014 21:22:16 +0100

On 23/08/2014 20:00, [email-masked] wrote:
> If we want key confirmation, we should send a key confirmation
> value outside the record layer encryption to solve this.

Not quite true. If the key confirmation is sent un-encrypted one still
has a problem as the BR key agreement security definition will not
apply.   So it depends what you mean by "secure".  The correct
definition should be to have a combined "KA+secure channel"
definition it would appear. There has been multiple work on this
over the last couple of years; much in relation to TLS.

Nigel

---

From: Watson Ladd <[email-masked]>
Date: Sat, 23 Aug 2014 14:26:16 -0700

On Aug 23, 2014 1:22 PM, "Nigel Smart" <[email-masked]> wrote:
>
> On 23/08/2014 20:00,[email-masked]:
>>

You are probably correct: I think BR can include key confirmation but I
need to think more about it. However I don't think we should weaken the
definitions in response to the failure of TLS to meet them, or even to say
clearly what it is trying to do. In particular some new features being
proposed don't have obvious security definitions.

Sincerely,
Watson Ladd
>
> Nigel
>
> _______________________________________________
> TLS mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tls