Re: [radext] I-D Action: draft-ietf-radext-tls-psk-03.txt

[Valery Smyslov <[e-mail]>]

[speaking as individual]

Hi Alan, Heikki,

one minor point.

> > OpenSSL 3.0 supports PSKs up to 512 octets (not bits)  which gives the possibility to have strong PSKs.
> The current text in the draft would at least require some justification if it is to be kept.
> 
>    Perhaps "Where TLS-PSK is used across the Internet, PSKs MUST contain at least 256 octets of
> entropy.".

I don't think that requiring the PSK to have 256 octets or more of entropy makes it stronger, at least for TLS 1.3.

The way PSK is used in TLS 1.3 always limits its entropy to the 
value of HKDF-Extract output size (*), it's 256 or 512 bits depending on the used hash function.
All the rest of PSK entropy (if any) is immediately lost.

That said, it may make sense having longer PSKs, because the method they are generated
may be imperfect, so the entropy may be far less than their length.

Regards,
Valery.

(*) I remember when Hugo Krawczyk explained this fact with regard to IKEv2 design - 
no matter how longer keys are used, the output of prf (HKDF-Extract in case of TLS 1.3)
limits the value of entropy in the protocol.

>   Alan DeKok.
> 
> _______________________________________________
> radext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/radext