Re: [TLS] issues with DTLS + PSK

[Hannes Tschofenig <[e-mail]>]

Hi Martin,

I was talking about PSK is used today in DTLS 1.2. Of course, in the
future (with TLS/DTLS 1.3) it might look differently and approach
mentioned below with #1 makes sense to me.

Ciao
Hannes


On 01/05/2015 07:41 PM, Martin Thomson wrote:
> On 5 January 2015 at 10:26, Hannes Tschofenig <[e-mail]> wrote:
>> Using DTLS-PSK in combination with DH is IMHO not particularly useful
>> since then you can also switch to a raw public key right away since you
>> loose all the performance and code size benefits that the PSK mechanism
>> provides with DTLS.
> 
> 
> The theory that I've heard regarding this was that we might have two modes:
> 
> 1. A PSK that mapped directly into session resumption (i.e., you are
> "resuming" some non-existent session).
> 
> 2. A PSK that followed the full handshake with DH.
> 
> While the latter is certainly slow and expensive, I think it was
> Carsten who suggested that some IoT devices would be interested in -
> occasionally - doing an ephemeral handshake.  Forward secrecy was a
> desirable property, and some devices would be able to do the work as
> long it was infrequent and there were no time-critical functions in
> progress.
>