Forbid key share reuse

[ekr]

Per discussion on the list. Note that I put this in the section on KeyShares and then removed the text about the impact of reuse on tracking, as it is no longer applicable.

[muhammad-usama-sardar]

What exactly do you mean by receiving implementations?

[ekr]

Implementations that receive key shares. I believe this to be adequately clear.

[muhammad-usama-sardar]

Thread for reference and easier finding in future

[martinthomson]

Very good. Ship it.

[thomwiggers]

The proposed changes are good for the main body. I do think we would do well to consider Nick Sullivan's clarification on the list:

Just to be clear about the scope of this change, it only prevents literal reuse of the same share. It does not rule out implementations generating related shares from shared secret material since that is not visible to the client. This change enforces non-reuse, not independence of key shares.

This is actually an important detail when considering security modeling of TLS 1.3. Putting this clarification that we're still not truly mandating ephemeral key exchange in the security considerations may be useful for future analysts.

[ekr]

Well, we don't take a position on how the key shares are generated at all, other than to say:

The key_exchange values for each KeyShareEntry MUST be generated independently.

Separately, I don't think it's helpful to use the terms "ephemeral" and "static". Historically, in TLS, "ephemeral" really meant that the key was explicit in the handshake rather than embedded in a credential. For example, TLS 1.0's "ephemeral RSA" keys were routinely reused.

[thomwiggers]

I am willing to bet that if I ask 10 cryptography academics what "generated independently" means, all of them will assume you are referring to ephemeral key exchange.

On the other hand maybe it's better to not have "this doesn't actually mean you need to do ephemeral key exchange" in the document at all, to avoid giving people ideas.

[ekr]

I am willing to bet that if I ask 10 cryptography academics what "generated independently" means, all of them will assume you are referring to ephemeral key exchange.

This text doesn't refer to the relationship between KeyShares in distinct connections at all. It refers to the relationship between the KeyShares in the same connection.

[thomwiggers]

Ah right, that was from another section of the draft. Thanks for the clarification.

[muhammad-usama-sardar]

On the other hand maybe it's better to not have "this doesn't actually mean you need to do ephemeral key exchange" in the document at all, to avoid giving people ideas.

@thomwiggers I don't find the text you quote anywhere in 8446bis or on the list. Could you please clarify which document and section you are referring to?