Re: [TLS] PSK in 1.3?

Thanks for the reminder.

I've been assuming we would keep it and trying to bear it in mind as I think
about design, but it's good to see this stated explicitly.

-Ekr

On Sun, Oct 19, 2014 at 10:30 AM, Manuel Pégourié-Gonnard <mpg@polarssl.org>
wrote:

> Hi,
>
> Sorry if this was discussed previously and I missed it, but I was wondering
> about the fate of PSK in TLS 1.3. The RSA and (EC)DH key exchanges were
> removed
> because they do not offer forward security. PSK does not offer FS either.
> OTOH,
> it has very interesting performance properties, namely it's the only key
> exchange that does not require asymmetric crypto.
>
> It seems to me it makes a lot of sense to keep it, even if it doesn't give
> FS.
>
> The reason I'm asking this now is the parallel discussion about new
> handshake
> flows and possibly proving them secure. If we're keeping PSK, maybe it's
> good to
> keep it in mind in this discussion, since it may have different properties
> than
> (EC)DHE for the proofs/security discussion.
>
> Manuel.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>