Subject: RE: [TLS] PSK question

From: [email-masked]
Date: Wed, 8 Dec 2004 19:27:38 +0200

Peter Gutmann wrote:
> 
> I was reading through the draft again an noticed:
> 
>   To help the client in selecting which identity to use, 
>   the server can provide a "PSK identity hint" in the 
>   ServerKeyExchange message (note that if no hint is 
>   provided, a ServerKeyExchange message is still sent)
> 
> I have no idea what an "identity hint" could possibly be (the 
> spec says it's optional, but I'd have no idea what to put in 
> there in any case).  If the field is used for something, what's 
> it supposed to be used for?  If not, perhaps it should be dropped.

This depends on how you manage the keys for TLS and what you're
using TLS for (the application). But the basic idea is the same
one as in listing certificate authorities in the CertificateRequest 
message, giving the client something more to work on in the
(probably rare) case that it has some choice.

(E.g., in the 3GPP GAA/GBA system, the hint tells the client
which "bootstrapping function" it should use to bootstrap a
shared key between the client and the server, if it hasn't
done that already.)

> (Hmm, and I'll repeat my earlier gripe that apart from its use
> to convey this unknown quantity, there's no need to send the
> server keyex at all.  In other words in 99.99% of cases it's
> just going to be code and message bloat).

I agree that in many cases it's 6 bytes of message bloat, but
I'm not so sure about the code bloat; it might even be simpler
not to have any special code paths for zero-length identity
hint. (And DH ciphersuites work this way, too; the
ClientKeyExchange message is sent even if it's empty.)

Best regards,
Pasi

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 09 Dec 2004 15:29:08 +1300

>shared key between the client and the server, if it hasn't

Having something like this in the text for guidance would be useful.
At the moment I know of no authentication protocol that needs or uses
an "identity hint", which makes it rather hard to see the utility of 
this field.

>hint.

I can't speak for anyone else, but in my case there's extra code needed
on both the server (to memcpy() in a fixed zero-contents message) and
client (to skip the same).

Peter.