Subject: [TLS] PSK in TLS 1.3

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 15 Mar 2016 21:46:28 +0100

Hi Ekr, Hi all,

I am not entirely sure about the PSK story in TLS 1.3.

In Section 6.2.3 I read that the PSK approach has been combined with
resumption.

Appendix A4 lists the defined ciphersuites but there is no PSK-based
ciphersuite in that list.

Section 6.3.1.2 explains that the ServerHello message handling:

"
The server will send this message in response to a ClientHello message
when it was able to find an acceptable set of algorithms and the
client’s “key_share” extension was acceptable. If the client proposed
groups are not acceptable by the server, it will respond with a
“handshake_failure” fatal ale
"

What this text should be saying is that the response from the server
depends on the selected ciphersuite. Implicitly you are saying that in
another part of the document, namely in Section 8.2 "MTI Extensions".

Ciao
Hannes

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 15 Mar 2016 14:28:28 -0700

> ciphersuite in that list.

This is editorial skew. I'll be adding them shortly.

> another part of the document, namely in Section 8.2 "MTI Extensions".

Sorry, I'm not following your question here. Can you say more?

-Ekr

> Ciao
> Hannes
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 21 Mar 2016 22:59:56 +0100

Hi Ekr,

~snip~

> Sorry, I'm not following your question here. Can you say more?

The conditions for the server to return a ServerHello are complex and
the wording is confusing.

The decisions are at least based on:

- Is there an acceptable set of algorithms and groups that are mutually
supported?

- Did the client’s KeyShare contain an acceptable offer?

- Is a KeyShare extension present?

- Is “signature_algorithms” extension present?

- Does msg offer (EC)DHE cipher suites?

Ciao
Hannes

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 21 Mar 2016 15:08:45 -0700

> - Does msg offer (EC)DHE cipher suites?

Ah, I see. Let me see if I can clear this up, if you wanted to send a PR,
that wouldn't
help too.

-Ekr

---

From: Dave Garrett <[email-masked]>
Date: Tue, 22 Mar 2016 00:22:33 -0400

On Monday, March 21, 2016 06:08:45 pm Eric Rescorla wrote:
> that wouldn't help too.

I assume you meant "wouldn't hurt" or "would help" here. ;)

Dave

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 22 Mar 2016 06:59:21 -0700

> I assume you meant "wouldn't hurt" or "would help" here. ;)

We won't know till we see it :) :)