extended-random

You have probably never used a crypto tool that used either Dual_EC or extended-random, for what it's worth.

You're still discussing this as if extended-random was an attempt to change the version of TLS that you and I use.

> You have probably never used a crypto tool that used either Dual_EC or extended-random, for what it's worth.

I am not arguing that NSA was pure of heart in proposing OpaquePRF/extended-random.

What I am saying is that there was no serious discussion that I can find for the deployment of OpaquePRF/extended-random on civilian networks.

I don't care what NSA's rationale for extended-random is.

It's extended-random I have questions about.

Moreover, if you look at the mailing list at the time, you'll see tens of other TLS standards people looking at extended-random and OpaquePRF, shrugging, and saying "this looks whatever ok fine".

His "involvement" with extended-random, so far as we know, is that someone in the Federal Government told him "here is a sketch of something we need to deploy TLS within the US Federal Government" (so far as I've been able to find, nobody has ever recommended that general-purpose implementations should adopt extended-random).

Extended-random was proposed as a way to allow DoD to deploy TLS on its networks, rather than using custom crypto protocols.