Subject: Re: [TLS] PSK in 1.3?

From: Peter Gutmann <[email-masked]>
Date: Tue, 21 Oct 2014 08:05:13 +0000

Manuel Pégourié-Gonnard <[email-masked]> writes:

>In addition to what Watson said, it's generally a bad idea to roll one's own
>crypto protocol, it's too easy to get things wrong. Even with PSK, TLS brings
>you important things: a record protocol, a way to derive session keys from the
>long-term secret key, etc.

I'm just reviewing a design right now for which there's been an argument put
forward that it's too complicated and you could roll your own protocol that
would be much simpler.  The implementers are using EAP-PSK, which is a wee bit
complex, but then it has exactly the benefits you cite, everything's well-
defined (although the lack of test vectors is annoying), you just grab the RFC
and code it up and you're done.  Sure, you could homebrew your own
application-specific protocol that's simpler, but then you'd end up with a
proprietary, non-vetted, nonstandard one-off custom job that nothing else on
earth can talk to.  That may be fine if you're building an Arduino-controlled
electronic cat-door for your home, but not if it's commercial SCADA gear
that's going to be deployed all over the world.

We'll see how the discussion over this pans out...

Peter.

---

From: Yoav Nir <[email-masked]>
Date: Tue, 21 Oct 2014 14:00:06 +0300

> On Oct 21, 2014, at 11:05 AM, Peter Gutmann <[email-masked]> wrote:
> 

Is that related to http://tools.ietf.org/html/draft-nir-tls-eap-13 ?

Yoav