[TLS] issues with DTLS + PSK

[Nikos Mavrogiannopoulos <[e-mail]>]

Some issues while using PSK in combination with DTLS.
1. The PSK ciphersuites rely on Finished messages mismatch to detect a
wrong preshared-key. That doesn't work well with DTLS where wrongly
encrypted messages are simply ignored. Thus there is no reasonable way
to detect wrong PSK keys except wait for some timeout.

2. Even if one would not ignore the finished message decryption issue,
and fail the handshake immediately, there is no way to notify the peer
of the failure. The exchanged keys don't match, so any alert message
will not be received by the peer.


A solution would be, on a revision of the PSK ciphersuites, to define
PSK ciphersuites which will authenticate (e.g., with a MAC), an (EC)DH
key exchange. That would allow a graceful failure in case of a mismatch
of keys. In addition it will allow the usage of hardware security
modules with PSK (something that is very hard to impossible with the
current ECDHE/DHE PSK ciphersuites).

regards,
Nikos