RFC 5705

Keying Material Exporters for Transport Layer Security (TLS)

📅 published March 2010, from ietf

RFC 5705: Keying Material Exporters for Transport Layer Security (TLS) 🎀

Okay bestie, this is RFC 5705 and it's giving serious main character energy 💅. It's an Internet Standards Track document, which means it went through the whole IETF process and got approved by the IESG for publication 🏆. It was written by E. Rescorla of RTFM, Inc., and it's dated March 2010 📅. Its ISSN is 2070-1721. Its header doesn't list any Obsoletes or Updates line, so there's no "replaces" or "changes" info up top to worry about ✨.

Abstract ✨

Okay so a bunch of protocols want to borrow Transport Layer Security (TLS) to set up their keys 🔐, but then they want to use some of those keys for their own stuff. This document describes a general mechanism that lets them do exactly that 💜.

Status of This Memo 📜

Okay so this is an Internet Standards Track document 🌟.

This document is a product of the Internet Engineering Task Force (IETF) 🧚. It represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication. If you want more info on Internet Standards, check out Section 2 of RFC 5741 📚.

For info on the current status of this document, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/5705 🔗.

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved 🦋.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date this document was published. Please read these carefully, because they describe your rights and restrictions for this document 🙈. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License.

This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008 🍓. The people who control the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The one exception is formatting it for publication as an RFC or translating it into languages other than English 🌈.

Table of Contents 🗂️

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
   2.  Conventions Used In This Document . . . . . . . . . . . . . . . 3
   3.  Binding to Application Contexts . . . . . . . . . . . . . . . . 3
   4.  Exporter Definition . . . . . . . . . . . . . . . . . . . . . . 4
   5.  Security Considerations . . . . . . . . . . . . . . . . . . . . 5
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 6
   7.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 6
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 7
     8.1.  Normative References  . . . . . . . . . . . . . . . . . . . 7
     8.2.  Informative References  . . . . . . . . . . . . . . . . . . 7

1. Introduction ✨

Note: The mechanism described in this document used to be called "TLS Extractors," but it got renamed to avoid a name clash with how the cryptographic community uses the word "Extractor" 🙈.

Okay so a bunch of protocols want to use Transport Layer Security (TLS) [RFC5246] or Datagram TLS (DTLS) [RFC4347] to set up keys, and then they want to use some of that keying material for their own purposes 💖. A really typical example is DTLS-SRTP [DTLS-SRTP], which is a key management scheme for the Secure Real-time Transport Protocol (SRTP) [RFC3711]. It uses DTLS to do a key exchange and to negotiate the SRTP protection suite, and then it takes the DTLS master_secret and generates the SRTP keys from it 🎧.

These applications mean you need to be able to export keying material (later called Exported Keying Material or EKM) from TLS/DTLS up to an application or protocol at a higher layer. You also need to securely agree on the upper-layer context where that keying material gets used 🔑. The mechanism for exporting the keying material has these requirements:

  • Both client and server need to be able to export the same EKM value.
  • EKM values should be indistinguishable from random data to attackers who don't know the master_secret.
  • It should be possible to export multiple EKM values from the same TLS/DTLS association.
  • Knowing one EKM value should not reveal any useful information about the master_secret or about other EKM values.

The mechanism in this document is designed to meet these requirements 🦋. It's compatible with all versions of TLS 👑.

2. Conventions Used In This Document 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💜.

3. Binding to Application Contexts 🎀

Okay so besides using an exporter to get keying material, an application that uses that keying material has to securely set up the upper-layer context where the keying material will be used 🫶. The details depend on the application. They could include things like the algorithms and parameters used with the keys, identifiers for the endpoints that will use the keys, identifiers for the sessions where the keys will be used, and the lifetimes of the context and/or the keys ⏳. At a minimum, there should be some mechanism for signaling that an exporter will be used 🌸.

This specification doesn't force one single mechanism for agreeing on that context. Instead, there are several options that can be used, and they can complement each other ✨. For example:

  • Info about the upper-layer context can go in the optional data after the exporter label (see Section 4).
  • Info about the upper-layer context can be exchanged in TLS extensions included in the ClientHello and ServerHello messages. This is the approach [DTLS-SRTP] uses. The handshake messages are protected by the Finished messages, so once the handshake finishes, both peers have the same view of the info 🔐. Extensions also allow a limited form of negotiation. For example, the TLS client could propose several alternatives for some context parameters, and the TLS server could pick one of them 🧚.
  • The upper-layer protocol can include its own handshake, and that handshake can be protected using the keys exported by TLS 🔥.

No matter how the context gets agreed, it is required that it has one part that says which application will use the exported keys. This part is the disambiguating label string (see Section 4) 🏷️.

It's important to note that just embedding TLS messages in the upper-layer protocol may not automatically secure all the important context info. That's because the upper-layer messages aren't covered by the TLS Finished messages 🙀.

4. Exporter Definition 💅

Okay so the output of the exporter is meant to be used in a single scope. That scope is tied to the TLS session, the label, and the context value 🌈.

The exporter takes three input values:

  • a disambiguating label string,
  • a per-association context value provided by the application using the exporter, and
  • a length value.

If no context is provided, it computes:

        PRF(SecurityParameters.master_secret, label,
            SecurityParameters.client_random +
            SecurityParameters.server_random
            )[length]

If context is provided, it computes:

        PRF(SecurityParameters.master_secret, label,
            SecurityParameters.client_random +
            SecurityParameters.server_random +
            context_value_length + context_value
            )[length]

Here, PRF is the TLS Pseudorandom Function in use for the session 🧁. The output is a pseudorandom bit string of length bytes generated from the master_secret. (This construction allows for interoperability with older exporter-type constructions that don't use context values, e.g., [RFC5281] 🦋.)

Labels here have the same definition as in TLS, meaning an ASCII string with no terminating NULL 🔤. Label values beginning with "EXPERIMENTAL" MAY be used for private use without registration. All other label values MUST be registered via Specification Required, as described by RFC 5226 [RFC5226] 📝. Note that exporter labels have the potential to collide with existing PRF labels. To prevent this, labels SHOULD begin with "EXPORTER". This is not a MUST, because there are existing uses whose labels don't begin with this prefix 🙈.

The context value lets the application using the exporter mix its own data into the TLS PRF for the exporter output 💜. One example of where this might be useful is an authentication setting where the client credentials are valid for more than one identity. The context value could then be used to mix the expected identity into the keying material, which prevents substitution attacks 🛡️. The context value length is encoded as an unsigned, 16-bit quantity (uint16; see [RFC5246], Section 4.4) representing the length of the context value 🔢. The context MAY be zero length. Because the context value is mixed with the master_secret via the PRF, it is safe to mix confidential information into the exporter, provided that the master_secret will not be known to the attacker 🔒.

Part 1 of 2. Part 2 picks up from here with the rest of the document! 🧚

5. Security Considerations 🔐✨

okay bestie, this section is THE most important one, so let's get into it 💅

The prime security requirement for exporter outputs is that they be independent. 🦋 More formally: after a particular TLS session, if an adversary is allowed to choose multiple (label, context value) pairs and is given the output of the PRF for those values, the attacker is still unable to distinguish between the output of the PRF for a (label, context value) pair (different from the ones that it submitted) and a random value of the same length. 😭 In particular, there may be settings, such as the one described in Section 4, where the attacker can control the context value; such an attacker MUST NOT be able to predict the output of the exporter. 🙈 Similarly, an attacker who does not know the master secret should not be able to distinguish valid exporter outputs from random values. The current set of TLS PRFs is believed to meet this objective, provided the master secret is randomly generated. 🔥

Because an exporter produces the same value if applied twice with the same label to the same master_secret, it is critical that two EKM values generated with the same label not be used for two different purposes -- hence, the requirement for IANA registration. 💀 However, because exporters depend on the TLS PRF, it is not a threat to the use of an EKM value generated from one label to reveal an EKM value generated from another label. 🌸

With certain TLS cipher suites, the TLS master secret is not necessarily unique to a single TLS session. 👑 In particular, with RSA key exchange, a malicious party acting as TLS server in one session and as TLS client in another session can cause those two sessions to have the same TLS master secret (though the sessions must be established simultaneously to get adequate control of the Random values). 😱 Applications using the EKM need to consider this in how they use the EKM; in some cases, requiring the use of other cipher suites (such as those using a Diffie-Hellman key exchange) may be advisable. 🫶

Designing a secure mechanism that uses exporters is not necessarily straightforward. 🧚 This document only provides the exporter mechanism, but the problem of agreeing on the surrounding context and the meaning of the information passed to and from the exporter remains. Any new uses of the exporter mechanism should be subject to careful review. 💜

6. IANA Considerations 📋🎀

IANA has created a TLS Exporter Label registry for this purpose. The initial contents of the registry are given below:

     Value                          Reference  Note
     -----------------------------  ---------  ----
     client finished                [RFC5246]  (1)
     server finished                [RFC5246]  (1)
     master secret                  [RFC5246]  (1)
     key expansion                  [RFC5246]  (1)
     client EAP encryption          [RFC5216]
     ttls keying material           [RFC5281]
     ttls challenge                 [RFC5281]

Note: (1) These entries are reserved and MUST NOT be used for the purpose described in RFC 5705, in order to avoid confusion with similar, but distinct, use in RFC 5246. 🙅‍♀️

Future values are allocated via the RFC 5226 Specification Required policy. The label is a string consisting of printable ASCII characters. IANA MUST also verify that one label is not a prefix of any other label. For example, labels "key" or "master secretary" are forbidden. 🚫

7. Acknowledgments 🌈

Thanks to Pasi Eronen for valuable comments and for the contents of the IANA section and Section 3. Thanks to David McGrew for helpful discussion of the security considerations and to Vijay Gurbani and Alfred Hoenes for editorial comments. 🫶💖

8. References 📚

8.1. Normative References

[RFC2119]    Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5226]    Narten, T. and H. Alvestrand, "Guidelines for Writing an
             IANA Considerations Section in RFCs", BCP 26, RFC 5226,
             May 2008.

[RFC5246]    Dierks, T. and E. Rescorla, "The Transport Layer
             Security (TLS) Protocol Version 1.2", RFC 5246,
             August 2008.

8.2. Informative References

[DTLS-SRTP]  McGrew, D. and E. Rescorla, "Datagram Transport Layer
             Security (DTLS) Extension to Establish Keys for Secure
             Real-time Transport Protocol (SRTP)", Work in Progress,
             February 2009.

[RFC3711]    Baugher, M., McGrew, D., Naslund, M., Carrara, E., and
             K. Norrman, "The Secure Real-time Transport Protocol
             (SRTP)", RFC 3711, March 2004.

[RFC4347]    Rescorla, E. and N. Modadugu, "Datagram Transport Layer
             Security", RFC 4347, April 2006.

[RFC5216]    Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS
             Authentication Protocol", RFC 5216, March 2008.

[RFC5281]    Funk, P. and S. Blake-Wilson, "Extensible Authentication
             Protocol Tunneled Transport Layer Security Authenticated
             Protocol Version 0 (EAP-TTLSv0)", RFC 5281, August 2008.

Author's Address 📮

Eric Rescorla
RTFM, Inc.
2064 Edgewood Drive
Palo Alto, CA  94303
USA

EMail: ekr@rtfm.com
📦 where this page comes from