TLSWG,

TLS 1.3 runs its entire key schedule on HKDF over SHA-2. This draft defines
an extension that replaces that schedule with one built on an
extendable-output function, so no SHA-2 remains in the key schedule: the
negotiated KDF governs every derivation, the Finished and binder MACs, and
the transcript hash.

This is draft-sullivan-tls-xof-ciphers-00, reworked and renamed. The old
name came from a design that negotiated the schedule through cipher suites.
The KDF now has its own extension, so the old name was wrong.

https://datatracker.ietf.org/doc/draft-sullivan-tls-xof-schedule/

What it does not change: the cipher suites, the AEAD algorithms, the state
machine, and the record layer. A connection whose ClientHello does not
carry the extension uses HKDF exactly as today; absence is the default, and
the default is TLS 1.3. The KDF is negotiated in its own extension carrying
a TLS KDF Identifier, so it is not bound to a cipher suite, and there is no
new TLS version. The draft updates RFC 9258.

Two KDFs are defined: SHAKE256, and the reduced-round TurboSHAKE256. Both
run the schedule on a single Keccak permutation, the one a deployment
already carries if it uses SHA-3, ML-KEM, or ML-DSA. The schedule is four
operations on a running sponge (Init, Absorb, Derive, Ratchet), and it
keeps RFC 9846's shape and its output names. One full handshake costs 39
permutation calls, against 117 for TLS 1.3 with KMAC primitives and 156 for
HKDF-SHA3-256 over the same permutation.

The draft states what is not yet established, in its own section: the
random-oracle substitution is argued rather than proven, the chaining
analysis over a carried accumulator is owed, the 12-round permutation is
not proven, and the EUF-CMA security of the reduced-round MAC is open. The
appendix now has tentative test vectors for both profiles.

The target is a SHA-2-free key schedule for PSK-only and post-quantum
deployments.

Nick

On Fri, Jul 24, 2026 at 3:29 PM <[email protected]> wrote:

> A new version of Internet-Draft draft-sullivan-tls-xof-schedule-00.txt has
> been successfully submitted by Nick Sullivan and posted to the
> IETF repository.
>
> Name:     draft-sullivan-tls-xof-schedule
> Revision: 00
> Title:    XOF-based key schedules for TLS 1.3
> Date:     2026-07-24
> Group:    Individual Submission
> Pages:    58
> URL:
> https://www.ietf.org/archive/id/draft-sullivan-tls-xof-schedule-00.txt
> Status:
> https://datatracker.ietf.org/doc/draft-sullivan-tls-xof-schedule/
> HTML:
> https://www.ietf.org/archive/id/draft-sullivan-tls-xof-schedule-00.html
> HTMLized:
> https://datatracker.ietf.org/doc/html/draft-sullivan-tls-xof-schedule
>
>
> Abstract:
>
>    TLS 1.3 runs its entire key schedule on HKDF over SHA-2.  This
>    document defines an extension that replaces that schedule with one
>    built on an extendable-output function (XOF): the negotiated KDF
>    governs every derivation, the Finished and binder MACs, and the
>    transcript hash, so no SHA-2 remains in the key schedule.  The cipher
>    suites, AEAD algorithms, state machine, and record layer are
>    unchanged, and a connection without the extension uses HKDF as today.
>    Two KDFs are defined, SHAKE256 and the reduced-round TurboSHAKE256.
>    This document updates RFC 9258.
>
>
>
> The IETF Secretariat
>
>
>
_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to