Re: [TLS] PSK in 1.3?

Viktor Dukhovni <> Tue, 24 February 2015 03:40 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id E52F41A010F for <>; Mon, 23 Feb 2015 19:40:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id C-_7QHeGcFT8 for <>; Mon, 23 Feb 2015 19:40:45 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 41DA51A00FF for <>; Mon, 23 Feb 2015 19:40:45 -0800 (PST)
Received: by (Postfix, from userid 1034) id A51EC282F52; Tue, 24 Feb 2015 03:40:43 +0000 (UTC)
Date: Tue, 24 Feb 2015 03:40:43 +0000
From: Viktor Dukhovni <>
Message-ID: <>
References: <> <> <> <mc9gjp$7nv$> <> <> <> <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <>
Subject: Re: [TLS] PSK in 1.3?
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 24 Feb 2015 03:40:47 -0000

On Mon, Feb 23, 2015 at 10:08:16PM -0500, Stephen Checkoway wrote:

> > It is obvious that a making n large enough can make a dictionary attack
> > moot. I have not said otherwise. It just doesn't make _the protocol_
> > resistant to dictionary attack.
> This isn't a useful distinction then since no mode of TLS is resistant to dictionary attacks by what I take to be your definition.

I'd like to suggest that this thread is going nowhere at present.

I don't think any of the below are controversial.

    * PSK is vulnerable to dictionary attacks when poor key management
      leads to a reduced key space.

    * PAKE protocols offer greater resistance to off-line dictionary

    * PSK *with properly selected keys* is secure in practice, once
      the brute force search is at least as expensive as brute-forcing
      the symmetric-algorithm keyspace.

    * No key management approach is perfect.

At which point it makes sense to step back and decide whether the
risk of reduced key-space with PSK warrants dropping support, even
though other approaches that are staying also have potential flaws.

Is there a suitable PAKE that is ready to replace all applications
of PSK?  Is it practical in all the environments that would otherwise
opt to use PSK?  If PSK is simply an obsolete needlessly weaker
shared secret system, then good riddance.  If not, then the discussion
should be about why PSK is more practical despite its limitations.