Subject: [TLS] Sharing PSKs with TLS 1.2 and 1.3

From: Christopher Wood <[email-masked]>
Date: Wed, 1 Aug 2018 18:56:38 -0700

Hi folks,

To address the lingering external PSK issue [1], Ekr proposed some advisory
text [2] for applications regarding how they should provision or use PSKs for
TLS 1.3 and 1.2. It reads as follows:

    TLS 1.3 takes a conservative approach to PSKs by binding them to a
    specific KDF. By contrast, TLS 1.2 allows PSKs to be used with any
    hash function and the TLS 1.2 PRF. Thus, any PSK which is used with
    both TLS 1.2 and TLS 1.3 must be used with only one hash in TLS 1.3,
    which is less than optimal if users want to provision a single PSK.
    In addition, while constructions in TLS 1.2 and TLS 1.3, although both
    based on HMAC, are very different and there is no known way in which
    reuse of the same PSK in TLS 1.3 and TLS 1.2 would produce related
    output, only limited analysis has been done of the safety of this
    practice. Implementations can ensure safety from cross-protocol key
    collisions by not reusing PSKs between TLS 1.3 and TLS 1.2. Future
    work such as [UNIVERSALPSK] or [SHAREDPSK] may result in a
    construction with a higher degree of flexibility and cryptographic
    assurance of key separation.

Please have a look and provide feedback on this change by the end of business
on Friday. We hope to close on this final issue by then.

Thanks,
Chris, Joe, and Sean

[1] https://www.ietf.org/mail-archive/web/tls/current/msg26693.html
[2] https://github.com/tlswg/tls13-rfc/pull/13

---

From: Martin Thomson <[email-masked]>
Date: Thu, 2 Aug 2018 12:07:29 +1000

This is the right sentiment.  Some editorial comments inline.

On Thu, Aug 2, 2018 at 11:57 AM Christopher Wood
<[email-masked]> wrote:
>     practice.

I had some difficultly parsing this sentence.  I think that it is two:

The constructions in TLS 1.2 and TLS 1.3 are different, although they
both based on HMAC.  Though there is no known way in which the same
PSK might produce related output in both versions, only limited
analysis has been done.

>     Future
>     work such as [UNIVERSALPSK] or [SHAREDPSK]

I would avoid citing specific drafts, particularly when we're still
unsure about where we want to go (maybe we want both, or neither).
I'd strike the "such as" bit here.

---

From: Christopher Wood <[email-masked]>
Date: Fri, 3 Aug 2018 14:11:09 -0700

> PSK might produce related output in both versions, only limited

+1 -- this is a nice improvement.

> I'd strike the "such as" bit here.

+1 here too. We might as well remove the entire sentence as it does
not add much value without the references.

Thanks,
Chris (chair hat on)