RE: [TLS] I-D ACTION:draft-ietf-tls-psk-null-00.txt

Bodo Moeller wrote:

> Is there a good case for definining a DHE_PSK ciphersuite with NULL
> encryption?  RSA_PSK involves server certificates, so it does not
> solely rely on pre-shared keys for authentication.  DHE_PSK, however,
> uses ephemeral Diffie-Hellman without certificate-based
> authentication.  This is very useful when the key exchange is used to
> obtain keys for symmetric encryption.  However, in these NULL
> encryption ciphersuites, the key exchange is only used to derive
> authentication keys, so there is only a very limited need for forward
> security.  (DHE_DSK, when using NULL encryption, provides protection
> against exposure of a pre-shared key if use of said key has been
> stopped, but TLS session based on the key remain active.)

With DHE_PSK, a passive eavesdropper doesn't get the information
required for a dictionary attack against the PSK.

So it might be useful even with NULL encryption in some environments
(where active MitM is not considered a significant threat, and the PSK
is not guaranteed to be "strong enough"). I'm not sure how common
those environments would be, but then again, I didn't think that
anyone would want NULL encryption either...

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls