Subject: [TLS] External PSK with certificate-based authentication

From: Russ Housley <[email-masked]>
Date: Sat, 2 Dec 2017 13:10:13 -0500

At the bottom of page 136, the current draft says:

   Note: TLS does not currently permit the server to send a
   certificate_request message in non-certificate-based handshakes
   (e.g., PSK).  If this restriction were to be relaxed in future, the
   client's signature would not cover the server's certificate directly.
   However, if the PSK was established through a NewSessionTicket, the
   client's signature would transitively cover the server's certificate
   through the PSK binder.  [PSK-FINISHED] describes a concrete attack
   on constructions that do not bind to the server's certificate (see
   also [Kraw16]).  It is unsafe to use certificate-based client
   authentication when the client might potentially share the same PSK/
   key-id pair with two different endpoints.  Implementations MUST NOT
   combine external PSKs with certificate-based authentication of either
   the client or the server.

[PSK-FINISHED] tells why it is not safe to do client authentication after resumption.

[Kraw16] says two things: (1) using a PSK from a previous handshake and adding client authentication is not secure; and (2)does not work; and the client signature must cover the public key.

So, the final sentence in the quoted paragraph seems to be too broad.  I do not see why we forbid an external PSK and certificate-based authentication in an initial handshake.  I acknowledge that TLS 1.3 does not support it, but I have been expecting an extension to be specified to do just that once the TLS 1.3 base specification is finished.

Russ

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 2 Dec 2017 10:51:45 -0800

On Sat, Dec 2, 2017 at 10:10 AM, Russ Housley <[email-masked]> wrote:

> [Kraw16] says two things: (1) using a PSK from a previous handshake and
> adding client authentication is not secure; and (2)does not work; and the
> client signature must cover the public key.
>
> So, the final sentence in the quoted paragraph seems to be too broad.  I
> do not see why we forbid an external PSK and certificate-based
> authentication in an initial handshake.  I acknowledge that TLS 1.3 does
> not support it, but I have been expecting an extension to be specified to
> do just that once the TLS 1.3 base specification is finished.
>

My view on this is that that's not a currently specified configuration. A
future specification could of course relax that. If you wanted to submit a
PR that said "absent some extension to the contrary" that would be fine,
though I think that's implicit.

-Ekr

Russ
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Russ Housley <[email-masked]>
Date: Thu, 7 Dec 2017 10:34:59 -0500

> On Dec 2, 2017, at 1:51 PM, Eric Rescorla <[email-masked]> wrote:
> 
> On Sat, Dec 2, 2017 at 10:10 AM, Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
> My view on this is that that's not a currently specified configuration. A future specification could of course relax that. If you wanted to submit a PR that said "absent some extension to the contrary" that would be fine, though I think that's implicit.

Please see https://github.com/tlswg/tls13-spec/pull/1117 <https://github.com/tlswg/tls13-spec/pull/1117>

Russ