Draft: draft-ietf-tls-tls13

Commentary: Just a few things I noticed that I think make it a little bit easier to follow . Name resumption_secret consistently when used Show full legend for each handshake flow Simplify / clarify secret sources table a bit and make text cases consistent The resumption secret naming was also apparently noticed by in issue . ( Edited to note : this PR has been pruned down to a smaller list of changes ; see commit message ) 
 Ok , to respond to comments I 've pushed a new commit . RE : capitalization : Upper or lower is fine , as long as it 's consistent . I 've switched it to all upper ( title case ) instead of all lower . RE : legend repetition : If you 're just reading one section , e.g. got to it via TOC , you might not have seen the legend ( recently ) . I 've made it less wordy now and also a line to indicate " + " is for extensions , as I realized that was n't necessarily clear . ( and a " + " where the notation was inconsistent ) We do have an extension that was previously a message , now . The basic point is consistency ; make each handshake flow make sense on its own . I think repeating the legend is helpful , but if you really do n't want to repeat it that I can cut this down to just the little stuff and table . Showing " N / A " instead of repeating things in the table is the most helpful part here , I think . It states that SS = ES in some circumstances elsewhere , but the table is n't clear that these are the exact same values , especially because the extracted ones are not . 
 Edited again and repushed for some more naming consistency . 
 Revised & rebased . Of note , I think these changes to the table make it far easier to see what 's going on here . 
 If you 're going to be rewriting this , I 'll just set those parts aside . The commit here is now just the little stuff : fix the spacing , add a line stating what SS / ES are in the list of derivations , and fix " shared_secret " ( there 's no such value named that ; just drop the underscore ) . 
 commit updated with fixes for your comments above 
 The key derivation process uses the " master secret " as the basis for application traffic keys and both the resumption and exporter secrets . There are lots of other secrets though . I do n't have a better name right now , so close this if none better can be found . Also s / resumption master secret / resumption secret/ throughout , it 's a little inconsistent . 
 Now master of more
Paragraph (version A):
The derivation process is as follows, where L denotes the length of
the underlying hash function for HKDF RFC5869.
Paragraph (version B):
The derivation process is as follows, where L denotes the length of
the underlying hash function for HKDF RFC5869.  SS and ES denote the
sources from the table above.  Whilst SS and ES may be the same in
some cases, the extracted xSS and xES will not.
Paragraph (version A):
A conventional Diffie-Hellman computation is performed.  The
negotiated key (Z) is used as the shared_secret, and is used in the
key schedule as specified above.  Leading bytes of Z that contain all
zero bits are stripped before it is used as the input to HKDF.
Paragraph (version B):
A conventional Diffie-Hellman computation is performed.  The
negotiated key (Z) is used as the shared secret, and is used in the
key schedule as specified above.  Leading bytes of Z that contain all
zero bits are stripped before it is used as the input to HKDF.