Subject: RE: [TLS] Some questions regarding PSK

From: [email-masked]
Date: Fri, 29 Apr 2005 10:35:19 +0300

Peter,

Your complaint about ServerKeyExchange being sent even when it
doesn't contain anything useful was already fixed in version -05
more than four months ago: Section 2 says that "If no hint is 
provided, the ServerKeyExchange message is omitted."

Markus's comment was about Section 3 (DHE_PSK), where we cannot
omit the whole ServerKeyExchange message because it contains
more than just the hint (server DH parameters).

Newer versions also clarify what to do with the identity hint;
see Section 5.2 in -08 version.

Best regards,
Pasi

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of ext Peter Gutmann
> Sent: Friday, April 29, 2005 6:50 AM
> To: [email-masked]; [email-masked]
> Subject: Re: [TLS] Some questions regarding PSK
> 
> 
> "Franke, Markus" <[email-masked]> writes:
> 
> > 1. In chapter 3 is stated "the ServerKeyExchange message is always
> > sent even if no PSK identity hint is provided". But how to 
> > not provide a identity hint?
> 
> I'd already complained about this weird requirement some time ago 
> ("a message whose only purpose is to indicate that the page is 
> intentionally left blank"), I thought this was fixed in more 
> recent drafts but it seems like it's still there.  The same with 
> the other comments, a few months after the above I sent another 
> comment:
> 
>   I have no idea what an "identity hint" could possibly be 
>   (the spec says it's optional, but I'd have no idea what to 
>   put in there in any case).  If the field is used for something, 
>   what's it supposed to be used for? If not, perhaps it should 
>   be dropped.
> 
>   (Hmm, and I'll repeat my earlier gripe that apart from its 
>   use to convey this  unknown quantity, there's no need to send 
>   the server keyex at all. In other  words in 99.99% of cases 
>   it's just going to be code and message bloat).
> 
> Can we finally get this fixed, or how many more times does it 
> have to be brought up as a problem with the spec?  The solution 
> is to make the ServerKeyExchange optional (it's not needed in 
> 99.99% of cases), and explain  what the identity hint is and 
> how it's used.
> 
> Peter.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 29 Apr 2005 20:13:14 +1200

>provided, the ServerKeyExchange message is omitted."

Oh, sorry about that, from the message it had looked as if it was the 
same old thing coming up again.

Peter.