Can TLS be used simply to exchange keys using the handshake protocol?

Question

From what I understand, in general, TLS consists of two protocols:

1 - Handshake protocol: uses public-key cryptography (ECDH, DH) to establish a shared secret between the client and server.

2 - Record protocol: uses the shared secret established in the handshake protocol to protect communication or application data between the client and server

Let's say I want to encrypt data and then use steganography to hide the encrypted data in an image, then I want to exchange the key used with the server using the handshake protocol BUT I do not want to send the steganographic image using the record protocol because it would defeat the purpose.

So, can I simply complete the handshake protocol and then drop the connection?

Answer 1

1 - Handshake protocol: uses public-key cryptography (ECDH, DH) to establish a shared secret between the client and server.

The handshake protocol is also used to establish a cipher suite, some configuration parameters and (usually) to perform entity authentication, amongst others.

So, can I simply complete the handshake protocol and then drop the connection?

The shared secret is only used to establish the session keys and might be destroyed after they've been established.

If you drop the connection the shared key should be destroyed by the implementation as well.

The session keys are TLS specific, and they are often not available from an TLS API for that reason.

---

So you could use part of the TLS handshake to establish a shared secret, but you'd go outside protocol specs if you use the session keys for anything else. If you use a TLS implementation you'd probably need to alter it to get to the right key material.

In your case it might be better to simply lift the relevant bits from the protocol and use that to define your own. Of course that would go against not using DIY cryptography, but I guess you've gone over that dangerous threshold already...

Answer 2

Maarten Bodewes claims that TLS provides no way for an application to use TLS to extract keying material; however, this is not the case. TLS does provide the key material exporter interface, which allows the two sides to derive secret keys (based on the TLS session) without exchanging any data records. This exported keys won't be the same as the traffic keys (or any other keys that TLS uses internally), however I don't believe you care about that.

Now, a specific TLS implementation may chose not to implement the interface; however you can just use a version that does.