Subject: [rtcweb] Short Authentication String for TLS/DTLS Draft

From: Eric Rescorla <[email-masked]>
Date: Fri, 14 Feb 2014 15:28:36 -0800

RTCWEB WG members may be interested in the following draft:

http://tools.ietf.org/html/draft-miers-tls-sas-00

This draft specifies a Short Authentication String feature for
TLS and DTLS which would allow a pair of communicating
to compare SAS values computed from the TLS/DTLS
handshake in order to detect active attack.

-Ekr

---

From: Adam Langley <[email-masked]>
Date: Fri, 14 Feb 2014 18:41:18 -0500

> handshake in order to detect active attack.

I think the draft should discuss why a channel binding doesn't work.
It's hinted at in the introduction but it's a subtle point because
they are otherwise very similar.

Given that I see M. Green as an author, should I assume that the
requirement for 64 bytes of randomness for a /short/ authentication
string is to ensure that users of Dual_EC DRBG have no problems
leaking the necessary entropy to a passive observer? :)

Cheers

AGL