OASIS Open

Google Inc.

Yes

1. I recommend moving the "CK_MECHANISM_TYPE prfHashMechanism" field to the end of the CK_TLS12_MASTER_KEY_DERIVE_PARAMS and CK_TLS12_KEY_MAT_PARAMS structs, and adding back the "CK_BBOOL bIsExport" field to the CK_TLS12_KEY_MAT_PARAMS struct. These changes will allow implementations to share more code between the TLS 1.2 mechanisms and the existing SSL 3.0 - TLS 1.1 mechanisms.

2. I recommend "TLS12_MAC" and "TLS10_MAC" be renamed "TLS12_FINISHED_MAC" and "TLS10_FINISHED_MAC", to make it clear these MACs are for the TLS Finished message rather than the TLS records.

3. I recommend allowing the "CK_MECHANISM_TYPE prfHashMechanism" field of the CK_TLS12_MAC_PARAMS struct to assume the special value CKM_TLS_PRF, which will select the TLS 1.0/1.1 PRF. This is similar to the design of the CKM_TLS_KDF mechanism, which can be used for all versions of TLS. This allows CKM_TLS12_MAC to supersede the CKM_TLS10_MAC_SERVER and CKM_TLS10_MAC_CLIENT mechanisms, and it would be nice to rename it CKM_TLS_MAC.

Comments 1 and 3 come from my experience with implementing this proposal. My implementation can be viewed at https://codereview.chromium.org/23510003/