Re: [radext] I-D Action: draft-ietf-radext-tls-psk-01.txt

[Alan DeKok <[e-mail]>]

On Aug 9, 2023, at 3:29 PM, Alexander Clouter <[e-mail]> wrote:
> I keep re-reading the following and I just don't "get it":
> 
> "If an implementation supports both TLS 1.2 and TLS 1.3, it MUST require that TLS 1.3 be negotiated in RADIUS/TLS and RADIUS/DTLS. This requirement prevents reuse of a PSK with multiple TLS versions, which prevents the attacks discussed in [RFC8446] Section E.7."

  The design of TLS 1.2 has issues.  If you use the same PSK for TLS 1.2 and TLS 1.3, then it's possible to attack TLS 1.2, get the PSK, and then use that to attack the TLS 1.3 connection.

  The solution is some hand-waving requirement to not use the same PSK across the TLS 1.3, and TLS <1.3 boundary.  How does that work in practice?  I'm unsure.

> So I am confused about what the action is here for an implementor if I want to support TLS-PSK on 1.2?

  If it's only used for TLS 1.2, fine.  But the requirement is for _different_ PSKs to be used for 1.2 and 1.3.

> Section 5:
> 
> "Implementations MUST use ECDH cipher suites", any reason why I cannot use anything else now or in the future? Should this be "MUST support" instead?

  Yes.

> Misc:

  Fixed, thanks.

  Alan DeKok.