Re: [TLS] Remove DH-based 0-RTT

> 
> The server signature is essentially over raw handshake messages, up
> to and including ServerCertificate. The first message that would
> depend on actual value of SS is ServerFinished, which comes after
> that point…

Yes Ilari, you’re right.

In my TRON talk, I described an attack on PSK+Signature server auth
which showed that the natural way of composing PSK + Sigs won’t work.
(And no it doesn’t work for PSK-ECDHE either.)

I think the proper way to do it is that the pre_shared_key extension
should include a ps_context value derived from the PSK. E.g for resumption,
it could include the session hash of the previous connection.
For pure PSK, it could include a MAC computed using the PSK.

It is worth noting that having such a psk_context in the client hello
would’ve prevented the attack that Cremers et al found in Tamarin as well.

Best,
Karthik

> 
> 
> -Ilari
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls