TLS 1.2 defines a PRF-like construction $P_{hash} : \{0,1\}^* \times \{0,1\}^* \rightarrow \{0,1\}^l$ for key derivation, etc. To quote the spec:
We define a data expansion function,
P_hash(secret, data)
, that uses a single hash function to expand a secret and seed into an arbitrary quantity of output:P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + HMAC_hash(secret, A(2) + seed) + HMAC_hash(secret, A(3) + seed) + ...
where
+
indicates concatenation.
A()
is defined as:A(0) = seed A(i) = HMAC_hash(secret, A(i-1))
Why does $P_{hash}$ invoke HMAC twice per block of output? Are there valid security arguments for doing so?
In particular, why not a simpler, faster, counter-based scheme such as:
$P_{hash}(\text{secret}, \text{seed}) = B(\text{secret},\text{seed},0) \| B(\text{secret},\text{seed},1) \| \dots \\ B(\text{secret},\text{seed},i) = \text{HMAC}_{hash}(\text{secret}, \text{to_byte}(i) \| \text{seed})$
If there is no technical advantage, what are the historical reasons behind this design?