Re: [TLS] PSK in 1.3?

[Manuel Pégourié-Gonnard <[e-mail]>]

On 19/10/2014 15:03, Yoav Nir wrote:
> I don’t see what the rationale can be to allow non-PFS for PSK
> authentication, but prohibit it for certificate authentication.  That would
> imply that we can make a blanket statement that the data passed in
> PSK-authenticated sessions is inherently low-value or non-private.  I don’t
> think we can make that statement.
> 
I think the point is that a non-FS PSK key exchange is orders of magnitude
cheaper in terms of computation time/power usage, RAM usage, and ROM footprint
which makes it a practical option in much more scenarios than the FS variants.

For non-PSK key exchanges however, there is some asymetric crypto going on
regardless of whether the exchange is FS or not. So while the non-FS version
might be cheaper, the cost difference is nowhere near as big as ECDHE-PSK vs PSK.

Also, while it would of course be simpler to be able to state that "TLS 1.3
offers FS" rather than "TLS 1.3 offers FS *except* for PSK", it should be noted
that there is almost no risk for PSK to be negotiated "by mistake" since the
keys need to be provisioned.

Manuel.