Re: [TLS] PSK in 1.3?

[Jeffrey Walton <[e-mail]>]

> I understand. It’s just weird that we’re treating non-PFS like it was made from asbestos, laced with arsenic and painted with lead paint, while this is proposing to allow asbestos/arsenic/lead combo as long as it’s much cheaper.
>
> ...
> So either we believe that PSK compromise is unlikely, or we believe that the data in a connection with a PSK ciphersuite is not future-sensitive. If we don’t, we’re saying that we’re just piling on security nice-to-haves because we think the users can handle them.
>
TLS-PSK provides mutual authentication and channel binding, which
addresses a major problem with RSA key transport: wrap a secret in
anybody's public key and send it (even if its the wrong server or
public key).

I'm not sure its wise to discard mutual authentication and channel
binding. They are improvements over key transport.