Re: [TLS] TLS 1.3 draft-07 sneak peek

[Dave Garrett <[e-mail]>]

On Tuesday, June 30, 2015 06:23:18 pm Eric Rescorla wrote:
> 2. Should we require that PSK cipher suites where the PSK is used for
> resumption use compatible ciphers?

https://github.com/tlswg/tls13-spec/compare/master...ekr:WIP_draft_07#diff-9d84740dcc569a0a5a359d0fba461a05R3037
+After the server has received the client Finished message, it MAY send
+a NewSessionTicket message. This message creates a pre-shared key
+(PSK) binding between the resumption master secret and the ticket
+label. The client MAY use this PSK for future handshakes by including
+it in the pre_shared_key extension in its ClientHello
+({{pre-shared-key-extension}}) and supplying a suitable PSK cipher
+suite.
+
+%%% Ticket Establishment
+      struct {
+          uint32 ticket_lifetime_hint;
+          opaque ticket<0..2^16-1>;
+      } NewSessionTicket;

The "suitable PSK cipher suite" & "resumption use compatible ciphers" issues would be simpler if the NewSessionTicket was just bound to a specified cipher suite (or vector of suites, but that's probably not needed). We could just add a cipher suite field here so the server tells the client exactly what it expects.


Dave