Re: [TLS] PSK in 1.3?

[Eric Rescorla <[e-mail]>]

On Sun, Oct 19, 2014 at 1:47 PM, Manuel Pégourié-Gonnard <[e-mail]>
wrote:

> On 19/10/2014 14:33, Ilari Liusvaara wrote:
> > Some notes about PSK in TLS 1.2:
> >
> > - TLS 1.2 has PSK identity hints. These are fundamentially 2RTT if used.
> > - PSK without identity hints is still 2RTT in TLS 1.2, but is not
> fundamentally
> >   2RTT (send identity in ClientHello).
>
> I was thinking that maybe this can use the same "optimistic with fallback"
> mechanism as the other key exchanges: initially the client chooses an
> identity
> and sends it in ClientKeyShare in the same flight as the initial
> ClientHello. If
> the server is happy with this identity, the normal 1.3 1RTT flow is used,
> otherwise the server sends back an identity hint and things start over at
> ClientHello.
>
> (Only a rough idea, I didn't think about it carefully yet.)


This was my assumption as well, though I also have not worked through it.

Is there any actual use for identity hints? Under what realistic
circumstances
does a client have more then one PSK for a given server?

-Ekr


>
> > - There is also DHE-PSK in TLS 1.2. There kex data is combination of PSK
> >   kex data and anonDH kex data. This one is PFS.
>
> For the sake of completeness, there is also ECDHE-PSK (RFC 5489) with the
> same
> properties.
>
> > - Then there is RSA-PSK in TLS 1.2. Too difficult to support and
> >   pretty much useless.
>
> Apparently not widely implemented currently, btw:
>
>
> https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Key_exchange_algorithms_.28alternative_key-exchanges.29
>
> > - 1RTT PSK also has some interactions with formulation of THS fix.
> >   Basically, one wants to force ServerHello to be always hashed.
> >
> That's the kind of things I was hoping you (and others with the relevant
> expertise) could mention!
>
> Manuel.
>