Re: [TLS] PSK in 1.3?

[Yoav Nir <[e-mail]>]

> On Oct 19, 2014, at 4:39 PM, Manuel Pégourié-Gonnard <[e-mail]> wrote:
> 
> On 19/10/2014 15:03, Yoav Nir wrote:
>> I don’t see what the rationale can be to allow non-PFS for PSK
>> authentication, but prohibit it for certificate authentication.  That would
>> imply that we can make a blanket statement that the data passed in
>> PSK-authenticated sessions is inherently low-value or non-private.  I don’t
>> think we can make that statement.
>> 
> I think the point is that a non-FS PSK key exchange is orders of magnitude
> cheaper in terms of computation time/power usage, RAM usage, and ROM footprint
> which makes it a practical option in much more scenarios than the FS variants.
> 
> For non-PSK key exchanges however, there is some asymetric crypto going on
> regardless of whether the exchange is FS or not. So while the non-FS version
> might be cheaper, the cost difference is nowhere near as big as ECDHE-PSK vs PSK.
> 
> Also, while it would of course be simpler to be able to state that "TLS 1.3
> offers FS" rather than "TLS 1.3 offers FS *except* for PSK", it should be noted
> that there is almost no risk for PSK to be negotiated "by mistake" since the
> keys need to be provisioned.

I understand. It’s just weird that we’re treating non-PFS like it was made from asbestos, laced with arsenic and painted with lead paint, while this is proposing to allow asbestos/arsenic/lead combo as long as it’s much cheaper.

I also understand that in practice, PSK ciphersuites are used only by small devices, whereas the web and SMTP and other things never went for it. But the standards don’t say that. They don’t say that PSK ciphersuites are especially for constrained devices. So if we insist that the same TLS 1.3 be used for both, and we don’t want to say that PSK is for weak security, then we should have a good story of why PFS is not needed for PSK uses, whereas it’s essential for all RSA uses.  If I understand the mechanism correctly, PSKs tend to be long-lived, and a subsequent compromise of a PSK (even if it is expired at the time of compromise) allows an attacker to decrypt the content of a TLS session. 

So either we believe that PSK compromise is unlikely, or we believe that the data in a connection with a PSK ciphersuite is not future-sensitive. If we don’t, we’re saying that we’re just piling on security nice-to-haves because we think the users can handle them.

Yoav