Re: [radext] I-D Action: draft-ietf-radext-tls-psk-03.txt

[Valery Smyslov <[e-mail]>]

Hi Heikki,

 

On Wed, 20 Sept 2023 at 11:11, Valery Smyslov < <mailto:[e-mail]> [e-mail]> wrote:

 

> > OpenSSL 3.0 supports PSKs up to 512 octets (not bits)  which gives the possibility to have strong PSKs.
> The current text in the draft would at least require some justification if it is to be kept.
> 
>    Perhaps "Where TLS-PSK is used across the Internet, PSKs MUST contain at least 256 octets of
> entropy.".

I don't think that requiring the PSK to have 256 octets or more of entropy makes it stronger, at least for TLS 1.3.

The way PSK is used in TLS 1.3 always limits its entropy to the 
value of HKDF-Extract output size (*), it's 256 or 512 bits depending on the used hash function.

 

Is it 384 bits TLS_AES_256_GCM_SHA384 cipher suite, when considering cipher suites defined in RFC 8446? 

 

          Yes.

 

In other words, since the rest in the RFC use SHA256, they are limited to 256 bits. And if there were cipher suites with SHA512, then those would be limited to 512 bits? 

 

          Yes, that’s what I meant (I should have written “from 256 to 512” :-))

 

I'm just curious to understand how these things go, I don't think it matters for the draft.

 

          No problem :-)

 

All the rest of PSK entropy (if any) is immediately lost.

That said, it may make sense having longer PSKs, because the method they are generated
may be imperfect, so the entropy may be far less than their length.

 

Here's the reason why OpenSSL 3.0 started supporting PSKs up to 512 octets:

    https://github.com/openssl/openssl/pull/12777

There seem to be devices that only accept 512 octet long PSKs.

 

Related to PSKs, OpenSSL 3.0 also increased PSK identity maximum length to 256 octets:

    https://github.com/openssl/openssl/pull/12771

The pull request has a pointer to a specification that uses very long PSK identity values. A web search finds a slideset with an example that uses 120 octet long identity.

 

(*) I remember when Hugo Krawczyk explained this fact with regard to IKEv2 design - 
no matter how longer keys are used, the output of prf (HKDF-Extract in case of TLS 1.3)
limits the value of entropy in the protocol.

 

Thanks for this information. Sounds like it's worth recommending long PSKs but it's not useful to aim for 256 octets of entropy. RFC 9257 says 128 bits (not octets) is required.

 

          Yes.

 

          Regards,

          Valery.

 

-- 

Heikki Vatiainen
[e-mail]