Re: [TLS] PSK in 1.3?

[Manuel Pégourié-Gonnard <[e-mail]>]

On 20/10/2014 21:20, Dan Harkins wrote:
>   The justification for these ciphersuites is some constrained device that
> has a small data and code size. But if you can not only generate 128-bit
> long uniformly random keys from a good source of entropy and also
> securely provision them on 2 (or more) devices then you don't need TLS.
> Just do static keyed symmetric crypto and you save even more data
> and code by eliminating TLS!
> 
In addition to what Watson said, it's generally a bad idea to roll one's own
crypto protocol, it's too easy to get things wrong. Even with PSK, TLS brings
you important things: a record protocol, a way to derive session keys from the
long-term secret key, etc.

>   In practice, these things are deployed by people who probably do not
> read the RFC in question, are in a hurry, and don't understand the
> security implications of their use of TLS. The PSKs that get provisioned
> are the ones that are easy to enter with a low probability of error-- i.e.
> something considerably less than uniformly random 128-bit key
> generated from a good source of entropy.
> 
I agree that's a real problem. But I don't think it has anything to do with your
previous definition of dictionary attack. As you said earlier, the size of the
pool from which the key is drawn does not change the fact the a protocol is or
isn't resistant to dictionary attack. My impression is that the size of the pool
(or more precisely the entropy of the key generator) is exactly the problem (and
from my understanding of your previous paragraph, we at least agree that it's an
important question).

>   - you can't ensure security with MUSTs and SHALLs; and,

That's one point I certainly agree with.

> TLS should be as misuse resistant as possible. That is, it should be as
> hard as possible to use improperly and that means no PSK ciphersuites.
> 
I agree about misuse resistance, and I agree it's a serious problem with the PSK
ciphersuites. I'm just not sure if it's serious enough to get rid of them.

I'd like to point out again that, in contrast with the NULL ciphersuites for
example, the mere existence of the PSK suites is less of a threat for the rest
of TLS, since there is very little risk of them being silently selected by
mistake. The problem is people who choose to use PSK but do it badly, but it
does not affect people who don't choose to use PSK.

Anyway, it's good to be discussing this explicitly.

Manuel.