TLSWG, TLS 1.3 runs its entire key schedule on HKDF over SHA-2. This draft defines an extension that replaces that schedule with one built on an extendable-output function, so no SHA-2 remains in the key schedule: the negotiated KDF governs every derivation, the Finished and binder MACs, and the transcript hash.
This is draft-sullivan-tls-xof-ciphers-00, reworked and renamed. The old name came from a design that negotiated the schedule through cipher suites. The KDF now has its own extension, so the old name was wrong. https://datatracker.ietf.org/doc/draft-sullivan-tls-xof-schedule/ What it does not change: the cipher suites, the AEAD algorithms, the state machine, and the record layer. A connection whose ClientHello does not carry the extension uses HKDF exactly as today; absence is the default, and the default is TLS 1.3. The KDF is negotiated in its own extension carrying a TLS KDF Identifier, so it is not bound to a cipher suite, and there is no new TLS version. The draft updates RFC 9258. Two KDFs are defined: SHAKE256, and the reduced-round TurboSHAKE256. Both run the schedule on a single Keccak permutation, the one a deployment already carries if it uses SHA-3, ML-KEM, or ML-DSA. The schedule is four operations on a running sponge (Init, Absorb, Derive, Ratchet), and it keeps RFC 9846's shape and its output names. One full handshake costs 39 permutation calls, against 117 for TLS 1.3 with KMAC primitives and 156 for HKDF-SHA3-256 over the same permutation. The draft states what is not yet established, in its own section: the random-oracle substitution is argued rather than proven, the chaining analysis over a carried accumulator is owed, the 12-round permutation is not proven, and the EUF-CMA security of the reduced-round MAC is open. The appendix now has tentative test vectors for both profiles. The target is a SHA-2-free key schedule for PSK-only and post-quantum deployments. Nick On Fri, Jul 24, 2026 at 3:29 PM <[email protected]> wrote: > A new version of Internet-Draft draft-sullivan-tls-xof-schedule-00.txt has > been successfully submitted by Nick Sullivan and posted to the > IETF repository. > > Name: draft-sullivan-tls-xof-schedule > Revision: 00 > Title: XOF-based key schedules for TLS 1.3 > Date: 2026-07-24 > Group: Individual Submission > Pages: 58 > URL: > https://www.ietf.org/archive/id/draft-sullivan-tls-xof-schedule-00.txt > Status: > https://datatracker.ietf.org/doc/draft-sullivan-tls-xof-schedule/ > HTML: > https://www.ietf.org/archive/id/draft-sullivan-tls-xof-schedule-00.html > HTMLized: > https://datatracker.ietf.org/doc/html/draft-sullivan-tls-xof-schedule > > > Abstract: > > TLS 1.3 runs its entire key schedule on HKDF over SHA-2. This > document defines an extension that replaces that schedule with one > built on an extendable-output function (XOF): the negotiated KDF > governs every derivation, the Finished and binder MACs, and the > transcript hash, so no SHA-2 remains in the key schedule. The cipher > suites, AEAD algorithms, state machine, and record layer are > unchanged, and a connection without the extension uses HKDF as today. > Two KDFs are defined, SHAKE256 and the reduced-round TurboSHAKE256. > This document updates RFC 9258. > > > > The IETF Secretariat > > >
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
