Re: [radext] WGLC for draft-ietf-radext-tls-psk-04

[Fabian Mauchle <[e-mail]>]

Finally getting around to work on this again after the Christmas/new 
year break, and too much of 'has to be completed before the end of the 
year'

On 01.12.2023 19:22, Alan DeKok wrote:
> On Dec 1, 2023, at 11:17 AM, Fabian Mauchle <[e-mail]> wrote:
>> After re-reading -04 and trying to update my implementation:
>>
>> 4.2.1.  Security of PSK Identities
>>> However, implementations MUST support managing PSK identities as a
>>> set of undistinguished octets
>>
>> This sentence confuses me (not sure why I didn't trip over it before).
>> If I follow the advise (SHOULD) of verifying identities as valid UTF-8, I would now violate above statement as I no longer support just any undistinguished octets.
> 
>    I don't think there's any contradiction.  Implementations MUST support identities as random stuff.  But it's generally a good idea to use UTF-8 for humanly-managed identities.

I don't agree - or I don't understand...

If a server chooses to reject non-UTF8 identities it very explicitly 
does NOT support identities as a set of undistinguished octets.
Supporting 'PSK identities as a set of undistinguished octets' to me 
means that I have to accept random stuff as an identity - even a 
zero-byte 0x00 - but if I reject this identity because it's not UTF-8, 
I'm violating this provision.

Turning this on its head:
Section 5.1 mandates support for UTF-8 identities on the client side. So 
why do we need a MUST requirement on the server side to support random 
(non-UTF-8) identities?

Again, I might completely misunderstand this requirement, but I don't 
like to ignore a MUST statement just because I don't know what to do 
with it.


>    Are resumption and PSK really mutually exclusive?  Just for completeness: yes for TLS1.3 PSK and resumption are mutually 
exclusive, per connection (I think this is different in TLS1.2).

 From the TLS1.3 protocol point of view, PSK and resumption are the same 
thing - it does not care if identity and key were provided by an admin 
or established using a session ticket.


-- 
Fabian Mauchle
Network
NOC:   [phone]
Direct:[phone]

Switch
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland