Re: [TLS] issues with DTLS + PSK

[Hannes Tschofenig <[e-mail]>]

Hi Nikos,

the issue you raise did not surface as a problem in the IoT space with
the use of DTLS. When you do not have the right key for authentication
in DTLS then waiting for the timeout is not going to be a big deal. Note
that this is not a user sitting in front of the machine and typing in
passwords. This is, as the name indicates, a shared secret-based mechanism.

Using DTLS-PSK in combination with DH is IMHO not particularly useful
since then you can also switch to a raw public key right away since you
loose all the performance and code size benefits that the PSK mechanism
provides with DTLS.

Ciao
Hannes


On 01/05/2015 05:08 PM, Nikos Mavrogiannopoulos wrote:
> Some issues while using PSK in combination with DTLS.
> 1. The PSK ciphersuites rely on Finished messages mismatch to detect a
> wrong preshared-key. That doesn't work well with DTLS where wrongly
> encrypted messages are simply ignored. Thus there is no reasonable way
> to detect wrong PSK keys except wait for some timeout.
> 
> 2. Even if one would not ignore the finished message decryption issue,
> and fail the handshake immediately, there is no way to notify the peer
> of the failure. The exchanged keys don't match, so any alert message
> will not be received by the peer.
> 
> 
> A solution would be, on a revision of the PSK ciphersuites, to define
> PSK ciphersuites which will authenticate (e.g., with a MAC), an (EC)DH
> key exchange. That would allow a graceful failure in case of a mismatch
> of keys. In addition it will allow the usage of hardware security
> modules with PSK (something that is very hard to impossible with the
> current ECDHE/DHE PSK ciphersuites).
> 
> regards,
> Nikos
> 
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>