Re: [radext] I-D Action: draft-ietf-radext-tls-psk-03.txt

[Heikki Vatiainen <[e-mail]>]

On Wed, 20 Sept 2023 at 11:11, Valery Smyslov <[e-mail]>
wrote:


> > > OpenSSL 3.0 supports PSKs up to 512 octets (not bits)  which gives the
> possibility to have strong PSKs.
> > The current text in the draft would at least require some justification
> if it is to be kept.
> >
> >    Perhaps "Where TLS-PSK is used across the Internet, PSKs MUST contain
> at least 256 octets of
> > entropy.".
>
> I don't think that requiring the PSK to have 256 octets or more of entropy
> makes it stronger, at least for TLS 1.3.
>
> The way PSK is used in TLS 1.3 always limits its entropy to the
> value of HKDF-Extract output size (*), it's 256 or 512 bits depending on
> the used hash function.
>

Is it 384 bits TLS_AES_256_GCM_SHA384 cipher suite, when considering cipher
suites defined in RFC 8446? In other words, since the rest in the RFC use
SHA256, they are limited to 256 bits. And if there were cipher suites with
SHA512, then those would be limited to 512 bits? I'm just curious to
understand how these things go, I don't think it matters for the draft.


> All the rest of PSK entropy (if any) is immediately lost.
>
> That said, it may make sense having longer PSKs, because the method they
> are generated
> may be imperfect, so the entropy may be far less than their length.
>

Here's the reason why OpenSSL 3.0 started supporting PSKs up to 512 octets:
    https://github.com/openssl/openssl/pull/12777
There seem to be devices that only accept 512 octet long PSKs.

Related to PSKs, OpenSSL 3.0 also increased PSK identity maximum length to
256 octets:
    https://github.com/openssl/openssl/pull/12771
The pull request has a pointer to a specification that uses very long PSK
identity values. A web search finds a slideset with an example that uses
120 octet long identity.

(*) I remember when Hugo Krawczyk explained this fact with regard to IKEv2
> design -
> no matter how longer keys are used, the output of prf (HKDF-Extract in
> case of TLS 1.3)
> limits the value of entropy in the protocol.
>

Thanks for this information. Sounds like it's worth recommending long PSKs
but it's not useful to aim for 256 octets of entropy. RFC 9257 says 128
bits (not octets) is required.

-- 
Heikki Vatiainen
[e-mail]