IETF Logo Mail Archive

Re: [TLS] PSK in 1.3?

"Paul Bakker" <p.j.bakker@offspark.com> Sun, 19 October 2014 15:00 UTC

Return-Path: <p.j.bakker@offspark.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2D901A1A99 for <tls@ietfa.amsl.com>; Sun, 19 Oct 2014 08:00:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.797
X-Spam-Level: *
X-Spam-Status: No, score=1.797 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_COM=0.553, HOST_EQ_NL=1.545, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hTJPtuRHp2fL for <tls@ietfa.amsl.com>; Sun, 19 Oct 2014 08:00:39 -0700 (PDT)
Received: from vps2.offspark.com (vps2.brainspark.nl [141.138.204.106]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AE8C1A1AA6 for <tls@ietf.org>; Sun, 19 Oct 2014 08:00:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=offspark.com; s=exim; h=Subject:Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:Date:In-Reply-To:References:Cc:To:From; bh=UV+Lq17eneVM/vA8KEZurm478Yj6Comve8o1mbv/1lA=; b=aNx1GsesTH7N4hqf8FXpN+t/3lD5itIkQU3z6/zNJQKzaYlvwweUUNmcqLYdx33y4JRtp7ksiQJ8AFLt7w8WdT0K9zR94fNi+36K5duADUSJmePnQcHndMSJBJ57hMy+K2azevTHWkXGB5L1VCPygXqAWFj6yRBVgzSIkCsQXGw=;
Received: from ip54507da9.speed.planet.nl ([84.80.125.169] helo=Slimpy) by vps2.offspark.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <p.j.bakker@offspark.com>) id 1XfryD-00026W-7o; Sun, 19 Oct 2014 17:00:33 +0200
From: Paul Bakker <p.j.bakker@offspark.com>
To: 'Yoav Nir' <ynir.ietf@gmail.com>, 'Manuel Pégourié-Gonnard' <mpg@polarssl.org>
References: <544384C7.9030002@polarssl.org> <78795A6D-3DFA-41C6-A380-C63DDF4C0285@gmail.com> <5443BF11.3090505@polarssl.org> <1D875BD8-2727-4895-842A-FC4FAA482E15@gmail.com>
In-Reply-To: <1D875BD8-2727-4895-842A-FC4FAA482E15@gmail.com>
Date: Sun, 19 Oct 2014 17:00:29 +0200
Message-ID: <00a201cfebad$704567a0$50d036e0$@offspark.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQJAzLJGdr3EjQQf6MQsY+EjboZpvQFsV1vAAZBKOUMCt7H1TpsoHThg
Content-Language: nl
X-SA-Exim-Connect-IP: 84.80.125.169
X-SA-Exim-Mail-From: p.j.bakker@offspark.com
X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-SA-Exim-Scanned: Yes (on vps2.offspark.com)
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/1k7UTSuxghe-jLt5AUv8ghqJK4I
Cc: tls@ietf.org
Subject: Re: [TLS] PSK in 1.3?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Oct 2014 15:00:40 -0000

> From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Yoav Nir
> Sent: zondag 19 oktober 2014 16:35
> I understand. It’s just weird that we’re treating non-PFS like it was made
> from asbestos, laced with arsenic and painted with lead paint, while this is
> proposing to allow asbestos/arsenic/lead combo as long as it’s much
> cheaper.

The usage scenario of PSK ciphersuites is also very different than from the other ciphersuites.

PSK ciphersuites are meant for closed user groups. Peers and servers are provisioned in advance with something they share. They often don't have a TTP they rely on, with certificates that can be 'demanded' by governments in dragnet-requests.

Regards,
Paul Bakker
PolarSSL lead maintainer

v2.23.0 | Report a Bug | By Email