Re: [TLS] Finished stuffing

[Martin Thomson <[e-mail]>]

On 9 September 2016 at 18:22, Ilari Liusvaara <[e-mail]> wrote:
> Basically, one can't make a distinction between static ("non-resumption)
> and dynamic ("resumption") PSKs here. Because such distinction would
> run into security problems with some other features.


You mean that there is no inherent property that forces separation
between sessions that use resumption vs. those that use a regular PSK.
Though the former is bound to an ALPN value and cipher suite (and
maybe some other things, like server identity) and cannot be used
unless those values remain fixed, whereas the latter is not.

We're imposing those restrictions artificially for convenience for the
most part, though 0-RTT can be used to justify the two values I
mentioned.  Given that you need the same coupling of PSK to
ALPN+cipher suite if you intend to use a non-resumption PSK for 0-RTT,
maybe instead we can fix your "problem" by identifying what needs to
be bound and forcing them to remain bound for all PSKs.  (I use scare
quotes here because I'm not convinced that it is a problem worth
worrying about.)

That limits choice, but it would remove any divergence between the two.

Note that we already couple the hash function to a PSK for very good
reasons.  So you can't use both ChaCha and AES-256 with the same PSK.