Re: [TLS] PSK in 1.3?

[Ilari Liusvaara <[e-mail]>]

On Sun, Oct 19, 2014 at 12:44:16PM +0100, Eric Rescorla wrote:
>
> On Sun, Oct 19, 2014 at 10:30 AM, Manuel Pégourié-Gonnard <[e-mail]>
> wrote:
> 
> > Hi,
> >
> > Sorry if this was discussed previously and I missed it, but I was wondering
> > about the fate of PSK in TLS 1.3. The RSA and (EC)DH key exchanges were
> > removed
> > because they do not offer forward security. PSK does not offer FS either.
> > OTOH,
> > it has very interesting performance properties, namely it's the only key
> > exchange that does not require asymmetric crypto.
>
> Thanks for the reminder.
> 
> I've been assuming we would keep it and trying to bear it in mind as I think
> about design, but it's good to see this stated explicitly.

Some notes about PSK in TLS 1.2:

- TLS 1.2 has PSK identity hints. These are fundamentially 2RTT if used.
- PSK without identity hints is still 2RTT in TLS 1.2, but is not fundamentally
  2RTT (send identity in ClientHello).
- TLS 1.2 PSK requires application protocol to specify use of identity
  hints for those to be usable. At least one RFC does so, and another
  punts it forward (there are too many references to that RFC to scan
  quickly).
- There is also DHE-PSK in TLS 1.2. There kex data is combination of PSK
  kex data and anonDH kex data. This one is PFS.
- Then there is RSA-PSK in TLS 1.2. Too difficult to support and
  pretty much useless.
- 1RTT PSK also has some interactions with formulation of THS fix.
  Basically, one wants to force ServerHello to be always hashed.


-Ilari