Re: [TLS] Comments on PR #95

[Ilari Liusvaara <[e-mail]>]

On Wed, Jan 07, 2015 at 01:40:56PM -0800, Tom Wu wrote:
> > Line 1912: Was anyone using SRP? The more generic we have to make TLS
> > 1.3, and the more we > have to shoehorn in, the more complex it gets.
> > This open issue could get hairy.
> 
> SRP is definitely useful, as it's the only PAKE ciphersuite available
> in TLS.  What exactly are the interactions that need to be worked out
> with PSK and SRP?

AFAIK, There issues are:

1) None of the groups defined for TLS are compatible with SRP.
2) Server will encrypt first (in TLS 1.2, client encrypted first).
   This may have cryptographic implications on SRP (and those are
   beyond my ability to analyze).
3) PSK has identities and identity hints.


A solution for 1)

If server selected SRP ciphersuite, it deems client to have missed
a group guess. The message about this includes the SRP group
parameters, and client then transmits its nonce public key
(with some fixed group number, the server knows the group).

A solution for 3)

If server selected PSK ciphersuite and client asked for a hint,
deem client to have missed the group guess. The message about this
includes hint about the identity. The client then transmits its
final identity (if doing "remedials", one could perhaps just
miss the identity and transmit it as a special handshake message).




-Ilari