[radext] Re: Selfie Attack on TLS-PSK

[Fabian Mauchle <[e-mail]>]

On 25.07.2024 00:00, Alan DeKok wrote:
> On Jul 24, 2024, at 1:37 PM, Margaret Cullen <[e-mail]> wrote:
>>
>> On a separate but related note….
>>
>> I came across this attack while reading about TLS mutual authentication:
>>
>> https://eprint.iacr.org/2019/347.pdf
>>
>    Nice!  And :(
>   
>> Is this something we should consider before we recommend the use of TLS-PSK with TLS 1.3? Or has this issues already been addressed?
> 
>    This is discussed in RFC 9527:
> 
>    https://datatracker.ietf.org/doc/html/rfc9257#section-8
> 
>    I'll have to do a deeper dive to see how this affects the TLS-PSK document.

Unless I missed something...

TLS-PSK the server identifies (and authorizes) the client based on the 
PSK identity, and authenticates it by the PSK key.

The client authenticates the server by the PSK key, and authorizes it by 
the sole fact that it knew the key.

So what we want to avoid is for servers accepting connections from 
clients that 'impersonate' the servers identity (it would itself use for 
outgoing connections).

Maybe we should add something to section 4.3. 'PSK and PSK Identity 
Sharing' like:

"Nodes that act both as client and server at the same time MUST NOT 
share or reuse PSK identities between incoming and outgoing connections."


This might also have implications on radiusdtls-bis, since current 
proposals allow skipping the identity check and authorize e.g. based on 
policy OID. Such a scenario might also be susceptible to to Selfie.

-- 
Fabian Mauchle
Network
NOC:    [phone]
Direct: [phone]

Switch
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland