I'm looking into using NSS with an EAP-TLS/PEAP/TTLS/FAST implementation. The initial part of this was relatively simple to complete since I already had a working EAP implementation with a wrapper layer to allow the TLS/crypto library to be changed. The NSPR file descriptor concept allowed the TLS socket to be replaced with custom I/O and I'm now at the point where I can run through EAP-PEAP authentication and the main missing part is deriving keying material (EAP MSK) based on the TLS session (client/server random, master secret). Based on a look through the NSS API, I did not find a clear mechanism for getting the information I would need for this.
Is there an API for extracting the client/server random and TLS master secret from NSS? Or alternatively, is there a mechanism that would allow NSS to be used as a PRF with these parameters (e.g., something similar to http://www.ietf.org/id/draft-ietf-tls-extractor-07.txt which will be published as an RFC shortly)? If not, are there any plans on adding such an API? - Jouni -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
