Re: [TLS] External PSK importers

[Russ Housley <[e-mail]>]

> On Oct 30, 2018, at 2:26 AM, Christian Huitema <[e-mail]> wrote:
> 
> On 10/29/2018 9:56 PM, Martin Thomson wrote:
> 
>> You should do something more concrete with the label parameter.  Keep
>> in mind that both client and server need to agree on a use for this,
>> so my initial intuition to put the server identity might not work, but
>> it could be a start.  The problem being that how the client identifies
>> the server might not be something it shares with the server.
> 
> There is also a privacy issue with the external identifiers. For session
> tickets, this is solved by only using a given resume ticket once, but
> that's harder with external PSK.

Christian:

Proclaiming that you have access to a particular external PSK may reveal that you as part of a group.  I do not see a way to completely avoid this because the PSK is input to the key schedule at the very top.  Thus, there is no key that could be used to encrypt it.

The importer described by Chris does provide some obfuscation of the base key identity, but an observer will be able to see each of the key identifiers that are derived, even if they cannot tell which one goes with a particular external PSK.  Padding with bogus key identifiers does not help either as the group membership may be revealed by watching which imported key identifier get selected by the server.

Russ