OpenVPN                                             Daniel Kubec <niel@rtfm.cz>
 RFC-5705                                                          February 2015
 
 
                 Added support for TLS Keying Material Exporters
 
 Keying Material Exporter [RFC-5705] allow additional keying material to be
 derived from existing TLS channel. This exported keying material can then be
 used for a variety of purposes. TLS allows client and server to establish
 keying material for use in the upper layers between the TLS end-points and
 channel bindings is straightforward and well-defined mechanism how to
 authenticate other layers.
 
 
 OpenVPN Configuration
 
 --keying-material-exporter label len
 
 Export Keying Material [RFC-5705] of len bytes (min. 16 bytes) using label in
 environment (exported_keying_material) for use by plugins in
 OPENVPN_PLUGIN_TLS_FINAL callback.
 
 Note that exporter labels have the potential to collide with existing PRF
 labels. In order to prevent this, labels MUST begin with "EXPORTER".
 (This option requires OpenSSL 1.0.1 or newer.)
 
 
 Use Cases:
 
 Secure bindings of AAA information to application layer
 
    OpenVPN Client                   <------>                 OpenVPN Server
    [KeyAgreement]                                            [KeyAgreement]
 
    [TLSExportedKeyingMaterial]                  [TLSExportedKeyingMaterial]
    [AAASessionKey]                                          [AAASessionKey]
    Client                           <------>                         Server
                       [Authenticated layer on top of (D)TLS]
 
 
 TLS side channel authentication and straightforward bindings of AAA information
 to application layer using well-defined mechanism.
 
    OpenVPN Client                   <------>                 OpenVPN Server
    [KeyAgreement]                                            [KeyAgreement]
 
    [TLSExportedKeyingMaterial]                  [TLSExportedKeyingMaterial]
    [DerivedAAABindingKey]                            [DerivedAAABindingKey]
                                                   [AuthenticateBindingKeys]
    Client                           ------->                         Server
                              [Confidental channel]
 
 
 TLS Message flow for a full handshake
 
    ClientHello                      -------->
                                                                ServerHello
                                                                Certificate*
                                                          ServerKeyExchange*
                                                         CertificateRequest*
                                     <--------              ServerHelloDone
    Certificate*
    ClientKeyExchange
    CertificateVerify*
    [ChangeCipherSpec]
    Finished                         -------->
                                                         [ChangeCipherSpec]
                                     <--------                     Finished
 
    GenerateTLSBindingKey                             GenerateTLSBindingKey
 
    Application Data                 <------->             Application Data
 
 
 Terminology
 
    AAA                     Authentication, Authorization, and Accounting:
                            functions that are generally required to control
                            access to a service and support auditing.
 
    Secure channel          a packet, datagram, octet stream connection, or
                            sequence of connections between two end-points that
                            affords cryptographic integrity and confidentiality
                            to data exchanged over it.
 
    Channel binding         the process of establishing that no man-in-the-middle
                            exists between two end-points that have been
                            authenticated using secure channel.
 
    TLS Binding Key         Exported Keying Material [RFC5705]
 
                            If no context is provided, it then computes:
                            PRF(SecurityParameters.master_secret, label,
                                SecurityParameters.client_random +
                                SecurityParameters.server_random
                            )[length]
 
                            If context is provided, it computes:
                            PRF(SecurityParameters.master_secret, label,
                                SecurityParameters.client_random +
                                SecurityParameters.server_random +
                                context_value_length + context_value
                            )[length]
 
    AAA Binding Key         TLS side channel authentication based on secure
                            channel bindings requires one more key derivation.
 
                            SHA1(TLSExportedKeyingMaterial + ServerPublicKey)
 
 Reference
 
    [OPENAAA]               "TLS side channel authentication and straightforward
                             bindings of AAA information to application
                             layer using well-defined mechanism."
                            Daniel Kubec <niel@rtfm.cz>              March 2013
                            https://github.com/n13l/openaaa
 
    [RFC5705]               "Keying Material Exporters for TLS"
                            E. Rescorla, RFC 5705 March 2010
                            http://tools.ietf.org/html/rfc5705
 
    [RFC5929]               "Channel Bindings for TLS"
                            J. Altman, N. Williams, L. Zhu, RFC 5929, July 2010
                            http://tools.ietf.org/html/rfc5929
 
    [RFC4680]               "TLS Handshake Message for Supplemental Data"
                            S. Santesson, RFC 4680, September 2006
                            http://tools.ietf.org/html/rfc4680
 
    [RFC5878]               "TLS Authorization Extension"
                            M. Brown, R. Housley, RFC 5878, May 2010
                            http://tools.ietf.org/html/rfc5878
 
    [RFC5746]               "TLS Renegotiation Indication Extension"
                            E. Rescorla, M. Raym, S. Dispensa, N. Oskov
                            RFC 5746, February 2010
                            http://tools.ietf.org/html/rfc5746