Re: [TLS] Distinguishing between external/resumption PSKs

[Mohit Sethi M <[e-mail]>]

Hi all,

Thanks Owen for starting this discussion. For some context, the EMU working group is currently working on a document titled "Using EAP-TLS with TLS 1.3": https://tools.ietf.org/html/draft-ietf-emu-eap-tls13-06

There has been recent discussion in the working group on whether EAP-TLS should support PSKs for the initial authentication. The current text says "Pre-Shared Key (PSK) authentication SHALL NOT be used except for resumption.".

As Richard points out, there is a distinction between "the server". Almost all EAP-TLS implementations use existing cryptographic libraries which handle the resumption PSK and PskIdentity. However, it is not clear (to me) who would set the PSKIdentity for the initial authentication. Should it be left to the application logic (in this case the EAP server)?

Do we care about PSKIdentity collisions? As Jonathan points out, having several PSKs with the same identity may require trial decryption and that can go wrong in several ways.

Chrisitian Huitema rightly points out that having free from PSKIdentity is good from a privacy perspective as an attacker cannot distinguish between initial authentication and resumption. However, if the server first has to lookup the resumption PSKs table before checking for any matching external PSKs, the timing information would leak that nonetheless.

Should a server issue NewSessionTickets when the original authentication itself was based on PSK? It would be nice to prevent tracking based on PSKIdentity.

We (or at least I) could certainly benefit with some more guidance from the TLS working group on this topic.

--Mohit

On 9/20/19 1:03 AM, Richard Barnes wrote:
On Thu, Sep 19, 2019 at 5:49 PM Nico Williams <[e-mail]<mailto:[e-mail]>> wrote:
On Thu, Sep 19, 2019 at 04:57:17PM -0400, Richard Barnes wrote:
> I don't think anyone's asking for these cases to be differentiable on the
> wire.  The question is whether the *server* can differentiate, in
> particular, the application running on the server.

And the answer to that one is "yes", because the server has control over
the PSK IDs.

That glosses over an important distinction made up-thread: When we say "the server", there is typically a distinction between the TLS stack and the server application logic.  Resumption PSKs are typically controlled by the TLS stack, while external PSKs are provided by the application logic.  The question is how the application logic, when presented with a session authenticated under a given PSK ID, can distinguish whether the PSK used was one provided by the TLS stack for resumption, or provided by the application logic.

--Richard



_______________________________________________
TLS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/tls