Pass AD_1 to the security application. <del> If any verification step fails, the Initiator MUST send an EDHOC </del>  error message back, formatted as defined in error, and the protocol MUST be discontinued.  If the Responder does not support the selected cipher suite, then SUITES_R MUST include one or more supported cipher

When the responder is processing message 1, section 4.4.3 reads: If any verification step fails, the Initiator MUST send an EDHOC error message back, formatted as defined in Section 5, and the protocol MUST be discontinued. I think this should be: If any verification step fails, the MUST send an EDHOC error message back, formatted as defined in Section 5, and the protocol MUST be discontinued. PR: URL

Pass AD_1 to the security application.  <ins> If any verification step fails, the Responder MUST send an EDHOC </ins> error message back, formatted as defined in error, and the protocol MUST be discontinued.  If the Responder does not support the selected cipher suite, then SUITES_R MUST include one or more supported cipher


4.1. <del> TODO(jonathan): writeme Shared session keys: Session key secrecy: Peer authentication: Session key uniqueness: Downgrade protection: Forward secrecy: KCI protection: Endpoint identity protection: 5. The TLS external PSK authentication makes the implicit assumption that each PSK is known only to one client and one server, which do not switch roles with the same PSK. </del> As discussed in use-cases, there are use cases where multiple clients or multiple servers share a PSK.  In such cases, TLS only authenticates the entire group.  Not only can a compromised group member impersonate another group member, but a malicious non-member can reroute handshakes between honest group members to connect them <del> in unintended ways.  This rerouting is a type of identity misbinding attack Sethi. </del>  <del> Selfie attack Selfie is a special case of the rerouting attack against a group member that can act both as TLS server and client. In the selfie attack, a malicious non-member reroutes a connection from the client to the server on the same endpoint. </del>  6.

Sorted the attacks into three classes.
NAME do you want to take a stab at this?
Fixed in .
... and describe attacks in all-honest (general) model.
NAME can you take this?
TLS 1.3 tries to maintain 8 security properties in the handshake. A naïve sharing of PSKs, even assuming only honest but curious participants know the key, can violate these properties. Let the group of peers who know the key be A, B, and C. Let the attacker compromise C. A sends a to B. The attacker intercepts it, and passes it to C. C, under the direction of the attacker, sends a to B, acting as A. B responds C thinking he is responding to A. C responds to A. A completes the handshake ostensibly with B, sending a message. C sends a message to B. B completes the handshake ostensibly with A. Although neither A nor B has been compromised, both have completed a session, ostensibly with each other, but have established different keys. Let the group of peers who know the key be A, B, and C. Let A complete a PSK handshake with B without performing a fresh DHE. C, an honest but curious agent, knows the PSK and can derive the session key. Let the group of peers who know the key be A, B, and C. A sends a to B. The attacker redirects the message to C. C responds to A. A completes the handshake ostensibly with B, sending a message. The attacker redirects the message to C. C completes the handshake ostensibly with A. Let the group of peers who know the key be A, B, and C. Let the attacker compromise C. A sends a with no key share to C. The attacker repeats the to B. B responds to C. The attacker repeats the response to A. A completes the handshake ostensibly with C, sending a message. The attacker repeats the message to B. B completes the handshake ostensibly with C. Although neither A nor B has been compromised they have each established a session with the attacker with the same key. Let the group of peers who know the key be A, B, and C. Let A and B support strong and weak cipher suites, but let C support only weaker cipher suites. A sends a to B. The attacker redirects the message to C. C responds to A choosing a weak cipher suite. A completes the handshake ostensibly with B, sending a message with a weak cipher suite. The attacker redirects the message to C. C completes the handshake ostensibly with A. Let the group of peers who know the key be A, B, and C. Let A establish a PSK session with B, without a fresh DHE. Let the attacker record the session. Let the attacker compromise C. The attacker can decrypt the recorded session, even though she compromised C after A and B completed their session. Let the group of peers who know the key be A, B, and C. Let the attacker compromise A. A sends a to B. The attacker intercepts the and responds using the PSK learned from A. A completes the handshake ostensibly with B, sending a message. Although B was never compromised the attacker is able to impersonate B to A. Although this has not seen any analysis, this appears to be secure, because even honest entities cannot distinguish each other.
Fixed in .
LGTM -- we can clean up nits after!

4.1.  As discussed in use-cases, there are use cases where multiple clients or multiple servers share a PSK.  In such cases, TLS only authenticates the entire group.  Not only can a compromised group member impersonate another group member, but a malicious non-member can reroute handshakes between honest group members to connect them  <ins> in unintended ways. The TLS external PSK authentication mechanism implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, standard TLS 1.3 security properties are invalidated. TLS 1.3 tries to maintain the following eight security properties: Matching the same session keys; Session key secrecy; Peer authentication; Session key uniqueness; Downgrade protection; Forward secrecy with respect to long-term keys; Key Compromise Impersonation (KCI) resistance; and Endpoint identity protection. A naive sharing of PSKs, even assuming only honest but curious participants know the key, can violate all these properties, bar one. Endpoint Identity Protection holds vacuously, because the client and server do not use certificates in PSK mode.  (This is not true with use of the "tls_cert_with_extern_psk" extension I-D.ietf-tls-tls13- cert-with-extern-psk.) In the following sub-sections, we list attacks that demonstrate violations of these properties when the fundamental PSK assumption does not hold. 4.1.1. This attack simply requires the adversary to reroute messages without changing any of their contents. Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows: 1.  "A" sends a "ClientHello" to "B" 2. The attacker intercepts the message and redirects it to "C" 3.  "C" responds with to "A" 4.  "A" sends a "Finished" message to "B" "A" has completed the handshake, ostensibly with "B".  5.  The attacker redirects the "Finished" message to "C" "C" has completed the handshake, ostensibly with "A". This attack violates the peer authentication property, and if "C" supports a weaker set of cipher suites than "B", this attack also violates the downgrade protection property.  This rerouting is a type of identity misbinding attack Sethi.  Selfie attack Selfie is a special case of the rerouting attack against a group member that can act both as TLS server and client.  In the Selfie attack, a malicious non-member reroutes a connection from the client to the server on the same endpoint. 4.1.2. If the client performs a PSK-based handshake without a DHE exchange, then another trivial attack is possible. Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows.  1.  "A" sends a "ClientHello" to "B", without including a key share 2.  The handshake completes as expected This attack violates the secrecy of session keys property, because even an honest but curious "C" can decrypt the session between "A" and "B".  This attack also violates forward secrecy, because a future compromise of "C" reveals the contents of the session, however RFC8446 notes that PSK-based handshakes without a fresh DHE do not achieve this property. 4.1.3. If the attacker compromises a client or server then the session is definitionally insecure, however sharing the key with more than one client and one server means that compromise of a different actor can lead to attacks. Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows.  1.  Let the attacker compromise "C" 2. "A" sends a "ClientHello" to "B" 3.  The attacker intercepts the message and creates a new "ClientHello" 4.  The attacker sends the new "ClientHello" to "B" 5.  "B" responds to "A" 6.  The attacker intercepts the message and creates a new response 7.  The attacker sends the new response to "A" 8.  "A" sends a "Finished" message to "B" "A" has completed the handshake, ostensibly with "B".  9.  The attacker intercepts the "Finished" message and creates a new "Finished" message 10.  The attacker sends the new "Finished" message to "B" "B" has completed the handshake, ostensibly with "A". This attack, and minor variants of it, violate the remaining properties outlined above.  The attack violates the same session keys property, as "A" and "B" have each completed a session, ostensibly with each other, and yet do not agree on the session key.  If "A" does not send a key share, then the attacker can have a session with "A" and a separate session with "B", where both sessions have the same key.  This violates the uniqueness of session keys property.  In the case of KCI resistance, where we assume the attacker has compromised "A", the attacker can successfully impersonate "B" to "A" using this pattern. </ins>  <ins> 5. </ins> 6.


OpenSSL and BoringSSL: Applications specify support for external PSKs via distinct ciphersuites.  They also then configure callbacks that are invoked for PSK selection during the handshake. <del> These callbacks must provide the PSK identity (as a character string) and key (as a byte string).  They are typically invoked with a PSK hint, i.e., the hint provided by the server as per RFC4279.  The PSK length is validated to be between [1, 256] bytes upon selection. </del>  mbedTLS: Client applications configure PSKs before creating a connection by providing the PSK identity and value inline. the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for <del> any operations.  TLS version 1.3 RFc8446 follows the same practice of </del>  specifying the psk identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1>). Implementations such as OpenSSL and mbedTLS nonetheless treat psk_identities as character strings and use string operators such <del> as strcmp on the psk identity. </del>  Implementations also assign default identities to PSKs (for example, the string 'Client_identity') if none are configured. 4. <del> Against a passive attacker AdvP or active attacker AdvA, desired privacy properties might include: Peer Authentication.  The client's view of the peer identity should reflect the server's identity.  If the client is authenticated, the server's view of the peer identity should match the client's identity.  Moreover, the client's view of the peer identity should not match its own identity Selfie. Channel Binding.  External PSKs should include channel bindings from any protocol run a priori to provision the PSKs. Identity Confidentiality.  AdvP should learn no information about the external PSK or its identifier.  Similarly, AdvA should be unable to replay ClientHello messages and learn information about the PSK. Identity Unlinkability.  AdvP should be unable to link two or more connections together that use the same external PSK. Unlinkability for the PSK receiver, i.e., ensuring that the recipient of a ClientHello with a given PSK k cannot link k to a prior session, is out of scope.  (PSKs are explicitly designed to support mutual authentication.) 4.1. As discussed in use-cases, there are use cases where multiple clients or multiple servers share a PSK.  In such cases, TLS only authenticates the entire group.  Not only can a compromised group member impersonate another group member, but a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways. The TLS external PSK authentication mechanism implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, standard TLS 1.3 security properties are invalidated. TLS 1.3 tries to maintain the following eight security properties: </del>  Matching the same session keys; Downgrade protection; <del> Forward secrecy with respect to long-term keys; </del>  <del> Key Compromise Impersonation (KCI) resistance; and </del>  <del> Endpoint identity protection. </del>  <del> A naive sharing of PSKs, even assuming only honest but curious participants know the key, can violate all these properties, bar one. Endpoint Identity Protection holds vacuously, because the client and server do not use certificates in PSK mode.  (This is not true with use of the "tls_cert_with_extern_psk" extension I-D.ietf-tls-tls13- cert-with-extern-psk.) </del>  In the following sub-sections, we list attacks that demonstrate violations of these properties when the fundamental PSK assumption changing any of their contents. Let the group of peers who know the key be "A", "B", and "C".  The <del> attack proceeds as follows: 1.  "A" sends a "ClientHello" to "B" 2. The attacker intercepts the message and redirects it to "C" 3.  "C" responds with to "A" 4.  "A" sends a "Finished" message to "B" "A" has completed the handshake, ostensibly with "B".  5.  The attacker redirects the "Finished" message to "C" "C" has completed the handshake, ostensibly with "A". </del>  This attack violates the peer authentication property, and if "C" supports a weaker set of cipher suites than "B", this attack also then another trivial attack is possible. Let the group of peers who know the key be "A", "B", and "C".  The <del> attack proceeds as follows.  1.  "A" sends a "ClientHello" to "B", without including a key share 2.  The handshake completes as expected </del>  This attack violates the secrecy of session keys property, because even an honest but curious "C" can decrypt the session between "A" lead to attacks. Let the group of peers who know the key be "A", "B", and "C".  The <del> attack proceeds as follows.  1.  Let the attacker compromise "C" 2. "A" sends a "ClientHello" to "B" 3.  The attacker intercepts the message and creates a new "ClientHello" 4.  The attacker sends the new "ClientHello" to "B" 5.  "B" responds to "A" 6.  The attacker intercepts the message and creates a new response 7.  The attacker sends the new response to "A" 8.  "A" sends a "Finished" message to "B" "A" has completed the handshake, ostensibly with "B".  9.  The attacker intercepts the "Finished" message and creates a new "Finished" message 10.  The attacker sends the new "Finished" message to "B" "B" has completed the handshake, ostensibly with "A". </del>  This attack, and minor variants of it, violate the remaining properties outlined above.  The attack violates the same session keys 5.  6. <del> TODO </del>  7. <del> TODO </del>

Addresses , , and .
... and don’t prohibit or otherwise interfere with PAKEs. (Though we may want to state that PAKEs should produce PSKs that adhere to this limit if run out of band.)
Fixed in .
Fixed in .
Start with the general recommendation and invariant: Identities should be unique across all nodes, roles, and keys. For each use case, how a part of the invariant is violated and leads to one of the known attacks.
Fixed in .

OpenSSL and BoringSSL: Applications specify support for external PSKs via distinct ciphersuites.  They also then configure callbacks that are invoked for PSK selection during the handshake.  <ins> These callbacks must provide a PSK identity (as a character string) and key (as a byte string).  (If no identity is provided, a default one is assumed.)  They are typically invoked with a PSK hint, i.e., the hint provided by the server as per RFC4279.  The PSK length is validated to be between [1, 256] bytes upon selection. </ins> mbedTLS: Client applications configure PSKs before creating a connection by providing the PSK identity and value inline. the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for  <ins> any operations.  TLS version 1.3 RFC8446 follows the same practice of </ins> specifying the psk identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1>). Implementations such as OpenSSL and mbedTLS nonetheless treat psk_identities as character strings and use string operators such  <ins> as "strcmp" on the psk identity. </ins> Implementations also assign default identities to PSKs (for example, the string 'Client_identity') if none are configured. 4.  <ins> TLS 1.3 tries to maintain the following seven security properties: </ins> Matching the same session keys; Downgrade protection;  <ins> Forward secrecy with respect to long-term keys; and </ins>  <ins> Key Compromise Impersonation (KCI) resistance. </ins>  <ins> To achieve these properties, the external PSK authentication mechanism implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, standard TLS 1.3 security properties are invalidated.  Section violations discusses attacks that are possible when this occurs. </ins>  <ins> 4.1. As discussed in use-cases, there are use cases where multiple clients or multiple servers share a PSK.  In such cases, TLS only authenticates the entire group.  Not only can a compromised group member impersonate another group member, but a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways.  A naive sharing of PSKs, even assuming only honest but curious participants know the key, can violate all these properties, bar one.  Endpoint Identity Protection holds vacuously, because the client and server do not use certificates in PSK mode. (This is not true with use of the "tls_cert_with_extern_psk" extension I-D.ietf-tls-tls13-cert-with-extern-psk.) </ins> In the following sub-sections, we list attacks that demonstrate violations of these properties when the fundamental PSK assumption changing any of their contents. Let the group of peers who know the key be "A", "B", and "C".  The  <ins> attack proceeds as follows: "A" sends a "ClientHello" to "B". The attacker intercepts the message and redirects it to "C". "C" responds with to "A". "A" sends a "Finished" message to "B".  "A" has completed the handshake, ostensibly with "B". The attacker redirects the "Finished" message to "C".  "C" has completed the handshake, ostensibly with "A". </ins> This attack violates the peer authentication property, and if "C" supports a weaker set of cipher suites than "B", this attack also then another trivial attack is possible. Let the group of peers who know the key be "A", "B", and "C".  The  <ins> attack proceeds as follows: "A" sends a "ClientHello" to "B", without including a key share. The handshake completes as expected. </ins> This attack violates the secrecy of session keys property, because even an honest but curious "C" can decrypt the session between "A" lead to attacks. Let the group of peers who know the key be "A", "B", and "C".  The  <ins> attack proceeds as follows: Let the attacker compromise "C". "A" sends a "ClientHello" to "B". The attacker intercepts the message and creates a new "ClientHello". The attacker sends the new "ClientHello" to "B". "B" responds to "A". The attacker intercepts the message and creates a new response. The attacker sends the new response to "A". "A" sends a "Finished" message to "B".  "A" has completed the handshake, ostensibly with "B". The attacker intercepts the "Finished" message and creates a new "Finished" message. The attacker sends the new "Finished" message to "B".  "B" has completed the handshake, ostensibly with "A". </ins> This attack, and minor variants of it, violate the remaining properties outlined above.  The attack violates the same session keys 5. <ins> Given the desired security goals from TODO, applications which make use of external PSKs MUST adhere to the following requirements: Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a server MUST use distinct PSKs when acting as the client from when it is acting as the server. Nodes SHOULD use external PSK importers I-D.ietf-tls-external-psk- importer when configuring PSKs for individual TLS connections. Each PSK MUST be at least 128-bits long. </ins> 6.  <ins> PSK privacy properties are orthogonal to security properties described in sec-properties.  Traditionally, TLS does little to keep PSK identity information private.  For example, an adversary learns information about the external PSK or its identifier by virtue of it appearing in cleartext in a ClientHello.  As a result, a passive adversary can link two or more connections together that use the same external PSK on the wire.  Applications should take precautions when using external PSKs if these risks. In addition to linkability in the network, external PSKs are intrinsically linkable by PSK receivers.  Specifically, servers can link successive connections that use the same external PSK together. Preventing this type of linkability is out of scope, as PSKs are explicitly designed to support mutual authentication. </ins> 7.  <ins> This document makes no IANA requests. </ins>


TODO  2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", PSKs, primarily for the purposes of supporting TLS connections with fast open (0-RTT data).  Internet of Things (IoT) and devices with limited computational capabilities.  RFC7925 defines TLS and DTLS profiles for resource- constrained devices and suggests the use of PSK ciphersuites for <del> compliant devices. </del>  Use of PSK ciphersuites are optional when securing RADIUS RFC2865 with TLS as specified in RFC6614. Secrets may be baked into or hardware or software device components, such as secure enclaves.  6.2. PSK provisioning systems are often constrained in application-

Notes: Certificateless server-to-server communication is definitively used for OTT communications e.g. URL

TODO <ins> 1.1. The guidance provided in this document is applicable across TLS RFC8446, DTLS I-D.ietf-tls-dtls13, and Constrained TLS I-D.rescorla- tls-ctls. </ins> 2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", PSKs, primarily for the purposes of supporting TLS connections with fast open (0-RTT data). <ins> Certificateless server-to-server communication.  Machine-to- machine communication may use externally provisioned PSKs, primarily for the purposes of establishing TLS connections without requiring the overhead of provisioning and managing PKI certificates. </ins> Internet of Things (IoT) and devices with limited computational capabilities.  RFC7925 defines TLS and DTLS profiles for resource- constrained devices and suggests the use of PSK ciphersuites for  <ins> compliant devices.  The Open Mobile Alliance Lightweight Machine to Machine Technical Specification LwM2M states that LwM2M servers MUST support the PSK mode of DTLS. </ins> Use of PSK ciphersuites are optional when securing RADIUS RFC2865 with TLS as specified in RFC6614. Secrets may be baked into or hardware or software device components, such as secure enclaves. <ins> Where secrets are baked into hardware at manufacturing time, the secrets may be printed on labels or included in a Bill of Materials for ease of scanning or import into a server. </ins> 6.2. PSK provisioning systems are often constrained in application-


one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened. <del> As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers share a PSK.  If this is done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall system is inherently rather brittle.  There are a number of obvious weaknesses here: </del>  Any group member can impersonate any other group member. non-member reroutes a connection from the client to the server on the same endpoint.  4. <del> Applications MUST use external PSKs that adhere to the following requirements: </del>  <del> Each PSK MUST be derived from at least 128 of entropy and MUST be at least 128-bits long unless the TLS handshake is being used with a separate key establishment mechanism such as a Diffie-Hellman exchange.  This recommendation protects against passive attacks using exhaustive search of the PSK. </del>  Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a

Discuss the different variants: High entropy PSK+DH High entropy PSK-only Low PSK with strong (balanced) PAKE ... and their security properties. For encodings, mention RFC1751 and Bjorn's draft.
Proposed text: If a high entropy PSK is used, then PSK-only key establishment modes are secure against both active and passive attack, but will not enjoy forward security. Forward security may be achieved by using a PSK-DH mode. If a low entropy PSK is used, then PSK-only key establishment modes are subject to passive exhaustive search passive attacks which will reveal the traffic keys. PSK-DH modes are subject to active attacks in which the attacker impersonates one side. The exhaustive search phase of these attacks can be mounted offline if the attacker captures a single handshake using the PSK, but those attacks will not lead to compromise of the traffic keys for that connection because those also depend on the DH exhange. Low entropy keys are only secure against active attack if a PAKE is used with TLS.

one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened.  <ins> use-cases discusses use cases where it is desirable for multiple clients or multiple servers share a PSK.  If this is done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall system is inherently rather brittle.  There are a number of obvious weaknesses here: </ins> Any group member can impersonate any other group member. non-member reroutes a connection from the client to the server on the same endpoint. <ins> Entropy properties of external PSKs may also affect TLS security properties.  In particular, if a high entropy PSK is used, then PSK- only key establishment modes are secure against both active and passive attack.  However, they lack forward security.  Forward security may be achieved by using a PSK-DH mode. In contrast, if a low entropy PSK is used, then PSK-only key establishment modes are subject to passive exhaustive search passive attacks which will reveal the traffic keys.  PSK-DH modes are subject to active attacks in which the attacker impersonates one side.  The exhaustive search phase of these attacks can be mounted offline if the attacker captures a single handshake using the PSK, but those attacks will not lead to compromise of the traffic keys for that connection because those also depend on the Diffie-Hellman (DH) exchange.  Low entropy keys are only secure against active attack if a PAKE is used with TLS. </ins> 4.  <ins> Applications MUST adhere to the following requirements for external PSKs: </ins>  <ins> Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH exchange for forward secrecy.  Low entropy PSKs, i.e., those derived from less than 128 bits of entropy, MUST be combined with a Password Authenticated Key Exchange (PAKE) mechanism. </ins> Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a


one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened. <del> use-cases discusses use cases where it is desirable for multiple clients or multiple servers share a PSK.  If this is done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall system is inherently rather brittle.  There are a number of obvious weaknesses here: </del>  Any group member can impersonate any other group member. 4. <del> Applications MUST adhere to the following requirements for external PSKs: Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH exchange for forward secrecy.  Low entropy PSKs, i.e., those derived from less than 128 bits of entropy, MUST be combined with a Password Authenticated Key Exchange (PAKE) mechanism. Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a server MUST use distinct PSKs when acting as the client from when it is acting as the server.  This prevents redirection attacks. Nodes SHOULD use external PSK importers I-D.ietf-tls-external-psk- importer when configuring PSKs for each pair of TLS client and server.  If a distinct importer is used for each pair, then this satisfies condition (2). Where possible the master PSK (that which is fed into the importer) SHOULD be deleted after the imported keys have been generated.  This protects an attacker from bootstrapping a compromise of one node into the ability to attack connections between any node; otherwise the attacker can recover the master key and then re-run the importer itself. 5. </del> PSK privacy properties are orthogonal to security properties described in sec-properties.  Traditionally, TLS does little to keep PSK identity information private.  For example, an adversary learns Preventing this type of linkability is out of scope, as PSKs are explicitly designed to support mutual authentication. <del> 6. </del>  Pre-shared Key (PSK) ciphersuites were first specified for TLS in 2005.  Now, PSK is an integral part of the TLS version 1.3 authentication with the usage of a certificate after successfully establishing the connection with a PSK. <del> 6.1. </del>  Many industrial protocols assume that PSKs are distributed and assigned manually via one of the following approaches: typing the secrets may be printed on labels or included in a Bill of Materials for ease of scanning or import. <del> 6.2. </del>  PSK provisioning systems are often constrained in application- specific ways.  For example, although one goal of provisioning is to identities.  Identities may sometimes need to be routable, as is currently under discussion for EAP-TLS-PSK. <del> 6.3. </del>  Most major TLS implementations support external PSKs.  And all have a common interface that applications may use when supplying them for wolfSSL: Applications configure PSKs with callbacks similar to OpenSSL. <del> 6.3.1. </del>  Section 5.1 of RFC4279 mandates that the PSK identity should be first converted to a character string and then encoded to octets using UTF- the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for <del> any operations.  TLS version 1.3 RFC8446 follows the same practice of specifying the psk identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1>). </del>  <del> Other assumptions unique to different stacks are listed below. </del>  <del> gnuTLS treats psk identities as usernames. </del>  7.  This document makes no IANA requests.

explain how tls exporter helps with KDF and mitigating selfie attacks. added text on psk identity usage.
I left it empty for Owen (NAME He was planning to contribute some text on PSK collisions (between external PSKs and between external and internal PSKs).
I'll merge and will remove it for now. Owen can add it when he gets around to his PR.
LGTM pending one orphan section!

one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened.  <ins> As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers share a PSK.  If this is done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall system is inherently rather brittle.  There are a number of obvious weaknesses here: </ins> Any group member can impersonate any other group member. 4.  PSK privacy properties are orthogonal to security properties described in sec-properties.  Traditionally, TLS does little to keep PSK identity information private.  For example, an adversary learns Preventing this type of linkability is out of scope, as PSKs are explicitly designed to support mutual authentication.  <ins> 5. </ins> Pre-shared Key (PSK) ciphersuites were first specified for TLS in 2005.  Now, PSK is an integral part of the TLS version 1.3 authentication with the usage of a certificate after successfully establishing the connection with a PSK.  <ins> 5.1. </ins> Many industrial protocols assume that PSKs are distributed and assigned manually via one of the following approaches: typing the secrets may be printed on labels or included in a Bill of Materials for ease of scanning or import.  <ins> 5.2. </ins> PSK provisioning systems are often constrained in application- specific ways.  For example, although one goal of provisioning is to identities.  Identities may sometimes need to be routable, as is currently under discussion for EAP-TLS-PSK.  <ins> 6. Applications MUST use external PSKs that adhere to the following requirements: Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH exchange for forward secrecy.  Low entropy PSKs, i.e., those derived from less than 128 bits of entropy, MUST be combined with a Password Authenticated Key Exchange (PAKE) mechanism. Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a server MUST use distinct PSKs when acting as the client from when it is acting as the server. Nodes SHOULD use external PSK importers I-D.ietf-tls-external-psk- importer when configuring PSKs for a pair of TLS client and server. Where possible the master PSK (that which is fed into the importer) SHOULD be deleted after the imported keys have been generated.  This protects an attacker from bootstrapping a compromise of one node into the ability to attack connections between any node; otherwise the attacker can recover the master key and then re-run the importer itself. 6.1. </ins> Most major TLS implementations support external PSKs.  And all have a common interface that applications may use when supplying them for wolfSSL: Applications configure PSKs with callbacks similar to OpenSSL.  <ins> 6.1.1. </ins> Section 5.1 of RFC4279 mandates that the PSK identity should be first converted to a character string and then encoded to octets using UTF- the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for  <ins> any operation.  TLS version 1.3 RFC8446 follows the same practice of specifying the PSK identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1> in the specification).  RFC8446 also requires that the PSK identities are at least 1 byte and at the most 65535 bytes in length.  Although RFC8446 does not place strict requirements on the format of PSK identities, we do however note that the format of PSK identities can vary depending on the deployment: </ins>  <ins> The PSK identity MAY be a user configured string when used in protocols like Extensible Authentication Protocol (EAP) RFC3748. gnuTLS for example treats PSK identities as usernames. </ins>  <ins> PSK identities MAY have a domain name suffix for roaming and federation. Deployments should take care that the length of the PSK identity is sufficient to avoid obvious collisions. identity-collision discusses some implication of collisions between external and resumption PSKs. 6.1.1.1. </ins> 7. <ins> It is NOT RECOMMENDED to share the same PSK between more than one client and server.  However, as discussed in use-cases, there are application scenarios that may rely on sharing the same PSK among multiple nodes.  I-D.ietf-tls-external-psk-importer helps in mitigating rerouting and selfie style reflection attacks when the PSK is shared among multiple nodes.  This is achieved by correctly using the node identifiers in the ImportedIdentity.context construct specified in I-D.ietf-tls-external-psk-importer.  It is RECOMMENDED that each endpoint selects one globally unique identifier and uses it in all PSK handshakes.  The unique identifier can, for example, be one of its MAC addresses, a 32-byte random number, or its Universally Unique IDentifier (UUID) RFC4122.  Each endpoint SHOULD know the identifier of the other endpoint with which its wants to connect and SHOULD compare it with the other endpoint's identifier used in ImportedIdentity.context.  It is however important to remember that endpoints sharing the same group PSK can always impersonate each other. 8. </ins> This document makes no IANA requests.


In addition to these, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as <del> detailed below. </del>  Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows:

The Selfie paper points out that if each party uses the SNI extension and terminates a connection on mismatch, rerouting attacks like Selfie aren't possible. I added this note to the explanation of such attacks.

In addition to these, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as  <ins> detailed below.  (Note that this class of attack is not possible if each member uses the SNI extension RFC6066 and terminates the connection on mismatch.  See Selfie for details.) </ins> Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows:


handshake, ostensibly with "B". The attacker redirects the "Finished" message to "C".  "C" has <del> completed the handshake, ostensibly with "A". </del>  This attack violates the peer authentication property, and if "C" supports a weaker set of cipher suites than "B", this attack also

Since "C", from its perspective, completes the handshake with "A" (without mistaking it for some other endpoint or something), I removed "ostensibly" from the description of the completion of the handshake.

handshake, ostensibly with "B". The attacker redirects the "Finished" message to "C".  "C" has  <ins> completed the handshake with "A". </ins> This attack violates the peer authentication property, and if "C" supports a weaker set of cipher suites than "B", this attack also


identities.  Identities may sometimes need to be routable, as is currently under discussion for EAP-TLS.  4. Against a passive attacker AdvP or active attacker AdvA, desired

First cut at . cc NAME
Thanks a lot. This looks good to start with. I think we should also discuss what kind of matching is done on the PSK identity. For example, RFC 7925 says: "For use with this profile, the PSK identities SHOULD NOT assume a structured format (such as domain names, distinguished names, or IP addresses), and a byte-by-byte comparison operation MUST be used by the server for any operation related to the PSK identity." Similarly, RFC 4279 in Section 5.1 describes the UTF-8 encoding of identities to improve interoperability for those cases where the identity is configured by a human using some management interface. If in TLS 1.3, the identity is only used as a hint for looking up the correct PSK in the database, then this would be a significant departure from what was the norm previously. Highlighting this in our document would make sense. The current text also says 'These callbacks must provide the PSK identity (as a character string)'. But the openssl sserver and sclient seem to work without providing PSK identities and use the default character string 'Clientidentity' as the pskidentity.
Merging and moving ^^ to an issue!
Applications configure callbacks that are invoked to select PSKs. These callbacks must provide the PSK identity () and key (char *`). URL mbedTLS also treats PSKs as arbitrary byte arrays and character strings. ... from URL URL URL Applications specify a "username" (as the PSK identity) and a raw PSK. URL URL Callback style (with identical key and identity types) similar to OpenSSL. There is no minimum length enforced for the PSK. URL URL
Fixed in .

identities.  Identities may sometimes need to be routable, as is currently under discussion for EAP-TLS. <ins> 3.3. Most major TLS implementations support external PSKs.  And all have a common interface that applications may use when supplying them for individual connections.  Details about existing stacks at the time of writing is below. OpenSSL and BoringSSL: Applications specify support for external PSKs via distinct ciphersuites.  They also then configure callbacks that are invoked for PSK selection during the handshake. These callbacks must provide the PSK identity (as a character string) and key (as a byte string).  They are typically invoked with a PSK hint, i.e., the hint provided by the server as per RFC4279.  The PSK length is validated to be between [1, 256] bytes upon selection. mbedTLS: Client applications configure PSKs before creating a connection by providing the PSK identity and value inline. Servers must implement callbacks similar to that of OpenSSL.  PSK lengths are validate to be between [1, 16] bytes. gnuTLS: Applications configure PSK values, either as raw byte strings or hexadecimal strings, and identities as "usernames". The PSK size is not validated. wolfSSL: Applications configure PSKs with callbacks similar to OpenSSL. </ins> 4. Against a passive attacker AdvP or active attacker AdvA, desired


federation. Deployments should take care that the length of the PSK identity <del> is sufficient to avoid obvious collisions. </del>  7.1.2.

I'm not sure what makes a collision obvious versus non-obvious, so let's remove the word "obvious."

federation. Deployments should take care that the length of the PSK identity  <ins> is sufficient to avoid collisions. </ins> 7.1.2.


Intra-data-center communication.  Machine-to-machine communication within a single data center or PoP may use externally provisioned PSKs, primarily for the purposes of supporting TLS connections <del> with fast open (0-RTT data). </del>  Certificateless server-to-server communication.  Machine-to- machine communication may use externally provisioned PSKs,

Since the term 'fast open' isn't used in RFC 8446, replace 'fast open' with the term that RFC 8446 uses for '0-RTT data'--namely, 'early data.'

Intra-data-center communication.  Machine-to-machine communication within a single data center or PoP may use externally provisioned PSKs, primarily for the purposes of supporting TLS connections  <ins> with early data. </ins> Certificateless server-to-server communication.  Machine-to- machine communication may use externally provisioned PSKs,


information about the external PSK or its identifier by virtue of it appearing in cleartext in a ClientHello.  As a result, a passive adversary can link two or more connections together that use the same <del> external PSK on the wire.  Applications should take precautions when using external PSKs to mitigate these risks. </del>  In addition to linkability in the network, external PSKs are intrinsically linkable by PSK receivers.  Specifically, servers can

Related issue and discussion: URL
NAME please let me know what you think of the suggestion above!
NAME I disagree that those analyses are out of scope since they concern the use of external PSKs, but if "out of scope" is understood to be synonymous with "we're not going to do it," then this change is fine. :)
Indeed -- "out of scope for this document" means "we're not doing it in this document."
Carrick Bartle in her review writes: What sort of precautions should they take? Do we want to make any recommendations. Jim Schaad provided some recommendation on the mailing list: URL [JLS] There are going to be three different cases for external PSK identities: The identity if factory provisioned and carried in a file to the server, the identity is factory provisioned and read by the user from the device, and it is hand chosen. The first two cases can definitely be randomized. I don’t know that having a minimum length makes any difference. This is not exactly a cryptographic property. Another thing that might be done would be analogous to the PSK importer document and apply a one way hash from the typed in value to the value that is sent over the wire so on the wire it is just a random set of bytes.
nit: s/his/her :-)
Isn't there a fourth case JLS didn't mention, namely some other out-of-band provisioning over a secure connection? In that case, a new PSK could be provisioned after each use. (This might seem silly, but I've seen two separate use-cases for this.) Alternatively, in any of those cases, is it feasible to do some sort of ratcheting? (This is sort of expanding on the last sentence in JLS's paragraph.)
Hmm, NAME there is. I'm wary about writing down any sort of recommendation here, though, as they would probably require analysis. (In contrast to the recommendations about PSK length, for which we understand the requirements quite well, I don't think we have a good way to reason about techniques to deal with external PSK privacy... yet.)
In that case, I'm in favor of deleting this line: "Applications should take precautions when using external PSKs to mitigate these risks." Mentioning precautions we don't describe is less helpful than not mentioning them at all (since it's confusing). Even better though would be to state that such precautions are an open problem that require analysis.
Yep, that seems reasonable to me!
NAME - At this point I would implement the - lets roll over the PSK on each use into the case of issuing tokens and just void the PSK (and token) on the first usage.
NAME What type of analysis are you looking for on this? It hardly needs to have a cryptographic analysis since this is not a cryptographic property. Are you looking for some analysis that the input and output cannot be correlated?
Minimally, yes.
While it may be odd - you could ask the PSK importer document to do this and just note the privacy problem here.
NAME would you mind proposing text (preferably for this document)?
NAME What sort of tokens are you referring to?
NAME In this case the token should be ticket. I have token on the brain because that is what we use for a similar idea in ACE.
NAME NAME do you think this issue is resolved?
Yep!
Excellent -- closing as is! Sent: Wednesday, July 8, 2020 1:03 AM To: Jim Schaad ; Mohit Sethi M ; EMAIL Cc: EMAIL Subject: Re: [TLS] Review of draft-ietf-tls-external-psk-guidance-00 Hi Jim, On 7/6/20 7:06 PM, Jim Schaad wrote: -----Original Message----- From: Mohit Sethi M Sent: Monday, July 6, 2020 3:10 AM To: Jim Schaad ; draft-ietf-tls-external-psk- EMAIL Cc: EMAIL Subject: Re: Review of draft-ietf-tls-external-psk-guidance-00 Hi Jim, Thanks for the review. A clarifying question in-line. In section 4 there is a statement that switching the roles of servers which use PSKs will lead to weakening of security properties. As this is a common scenario today in situations where you are doing server-to-server communication, it would be useful to discuss just how and how much this weakening occurs. This was a complete surprise to me and I don't know if it was supposed to be one. Are there mitigations that can be made? In section 7, The first sentence does not read, also It seems a bit difficult to have a MUST in there when most of the items below are SHOULDs. That seems to be a dissonance. Section 7.1.1 - The idea of having domain name suffixes on PSKs seems to me to be a bad idea as this would seem to lower privacy levels. I think you are referring to the PSK identity and not to the PSK. As you know, the Network Access Identifiers (NAIs) used in EAP typically need the domain name suffix for roaming, federation, etc. This is true, it is also true that EAP is very strong on saying that if you have a choice, always send an anonymous version of the NAI if you have to do it in the clear. This means that the domain can be used for correlation, but you do not have the full identity for that purpose. I think that the EMU group is going to need to look at what level of privacy protection it is going to desire when using a PSK, but in that case there is no need for having a domain suffix as that information is provided elsewhere. This might require keeping the TLS tunneling as an option to deal with passive attacks. You are absolutely right about the preference for using anonymous identities. draft-ietf-emu-eap-tls13 currently says the following about resumption: It is RECOMMENDED to use a NAIs with the same realm in the resumption and the original full authentication. This requirement allows EAP packets to be routable to the same destination as the original full authentication. If this recommendation is not followed, resumption is likely to be impossible. When NAI reuse can be done without privacy implications, it is RECOMMENDED to use the same anonymous NAI in the resumption, as was used in the original full authentication. E.g. the NAI NAME can safely be reused, while the NAI ZmxleG8=NAME cannot. This document and the ensuing discussion pertains only to external PSKs and external PSK identities. I think I incorrectly used the word "issue" in my previous email as a more correct choice would have been "agree/establish" (i.e. the server and client agree on an external PSK and an external PSK identity). RFC 8446 doesn't place any restrictions on external PSK identities (other than the fact that they are at least 1 byte). If we are going to discourage the use of domain names in external PSK identities, would that be sufficient? What prevents me from using an external PSK identity of the type: mystrongsecretpskwithamazonserver? I am not sure if we should recommend randomized external PSK identities of a certain minimum length. Perhaps it might be better to add a disclaimer about the privacy loss from carelessly chosen external PSK identities? [JLS] There are going to be three different cases for external PSK identities: The identity if factory provisioned and carried in a file to the server, the identity is factory provisioned and read by the user from the device, and it is hand chosen. The first two cases can definitely be randomized. I don’t know that having a minimum length makes any difference. This is not exactly a cryptographic property. Another thing that might be done would be analogous to the PSK importer document and apply a one way hash from the typed in value to the value that is sent over the wire so on the wire it is just a random set of bytes. Jim --Mohit I would like to understand the nature of the resulting privacy loss. Is it that a passive attacker can now easily determine the server which issued the PSK identity (and the server where it will eventually be used)? While it I true that at least some of the privacy information has already been leaked in the PSK case, you know the address that is being talked to and the PSK identity that is passed. If you look at using thigs like ESNI, doing this would appear to potentially give away the very information that is being hidden in that case. The other problem with having domain based KIDs is that you could easily get some amount of correlation between the KIDs that are assigned in different domains. You could end up with URL and URL and it would be quite reasonable to assume that both of those identities are going to be for the same entity, just in different domains. Jim --Mohit Section 7.1.2 - There seem to me to be three different places where collisions will occur. The importer function could get a collision, there could be collisions with pre-TLS 1.2 external identifiers and there could be collision with resumption keys. There has been a huge discussion about this in the EMU group and I don't find the text here to be sensible in term of whether this is or is not a problem. Section 7.1.2 - One of the things that I kept meaning to get to and just haven't done so yet, is dealing with the question of can the TLS Key binders in the handshake to distinguish between multiple keys that happen to have the same identity. Perhaps you should look to see if this does work and if it is safe. Jim TLS mailing list EMAIL URL

information about the external PSK or its identifier by virtue of it appearing in cleartext in a ClientHello.  As a result, a passive adversary can link two or more connections together that use the same  <ins> external PSK on the wire.  Techniques for mitigating these risks require analysis and are out of scope for this document. </ins> In addition to linkability in the network, external PSKs are intrinsically linkable by PSK receivers.  Specifically, servers can


3. Pre-shared Key (PSK) ciphersuites were first specified for TLS in <del> 2005.  Now, PSK is an integral part of TLS 1.3 specification [RFC8846].  TLS 1.3 also uses PSKs for session resumption.  It distinguishes these resumption PSKs from external PSKs which have been provisioned out-of-band (OOB).  Below, we list some example use- cases where pair-wise external PSKs with TLS have been used for authentication.  Note that the following list is non-exhaustive: </del>  Device-to-device communication with out-of-band synchronized keys. PSKs provisioned out-of-band for communicating with known with fast open (0-RTT data). Internet of Things (IoT) and devices with limited computational <del> capabilities.  The Constrained Application Protocol (CoAP) RFC7252 is a web transfer protocol intended for resource-constrained IoT devices.  It suggests use of the TLS_PSK_WITH_AES_128_CCM_8 ciphersuite with DTLS for securing communication between CoAP clients and servers.  RFC7925 defines TLS and DTLS profiles for resource-constrained devices and requires compliant devices to support the TLS_PSK_WITH_AES_128_CCM_8 ciphersuite. Wireless Networks.  The Control And Provisioning of Wireless Access Points (CAPWAP) protocol specification RFC5415 mandates support of TLS_PSK_WITH_AES_128_CBC_SHA and TLS_DHE_PSK_WITH_AES_128_CBC_SHA ciphersuites with DTLS for authentication between the centralized Access Controller (AC) and distributed Wireless Termination Points (WTPs).  Use of PSK ciphersuites are Ooptional when securing RADIUS RFC2865 with TLS as specified in RFC6614.  The Generic Authentication Architecture (GAA) defined by 3GGP in TR 133 919 V12.0.0 (https://www.etsi.org/deliver/ etsi_tr/133900_133999/133919/12.00.00_60/tr_133919v120000p.pdf) </del>  mentions that TLS-PSK can be used between a server and user <del> equipment for authentication. </del>  Smart Cards.  The electronic German ID (eID) card supports <del> authentication of a card holder to online services with TLS-PSK. The German Federal Office for Information Security (BSI) describes how TLS-PSK authentication is utilized in the eCard-API-Framework specification (TR-03112-7:https://www.bsi.bund.de/SharedDocs/Downl oads/DE/BSI/Publikationen/TechnischeRichtlinien/TR03112/TR- 03112-api_teil7.pdf?__blob=publicationFile&v=1).  EMV support for TLS-PSK I-D.urien-tls-psk-emv discusses how the identities and PSK attributes for TLS-PSK can be extracted from EMV cards. </del>  There are also use cases where PSKs are shared between more than two <del> entities.  Some examples are below: </del>  <del> Group chats.s In this use-case, the membership of a group is </del>  confirmed by the possession of a PSK distributed out-of-band to the group participants.  Members can then establish peer-to-peer connections with each other using the external PSK.  It is 3.1. Many industrial protocols assume that PSKs are distributed and <del> assigned by manually via one of the following approaches: typing the PSK into the devices, or via a web server masks (using a TOFU approach with a device completely unprotected before the first login did take place).  Many devices have very limited GUI functionalities.  For example, they only a numeric keypad or even only five buttons.  So when the TOFU approach is not suitable in a setting, entering the key would require typing it on a constrained HMI interface.  Moreover, PSK production lacks guidance, similar to user passwords. </del>  Some devices are provisioned PSKs via an out-of-band, cloud-based syncing protocol. Secrets may be baked into or hardware or software device <del> components, such as secure enclaves.s </del>  3.2. another example, some systems require the provisioning process to embed application-specific information in either PSKs or their identities.  Identities may sometimes need to be routable, as is <del> currently under discussion for EAP-TLS. </del>  3.3. 5. <del> TODO </del>  6.

Moved links in use cases sections to references and made the text somewhat more concise. Added some initial text on known attacks.

3. Pre-shared Key (PSK) ciphersuites were first specified for TLS in  <ins> 2005.  Now, PSK is an integral part of the TLS version 1.3 specification RFC8446.  TLS 1.3 also uses PSKs for session resumption.  It distinguishes these resumption PSKs from external PSKs which have been provisioned out-of-band (OOB).  Below, we list some example use-cases where pair-wise external PSKs with TLS have been used for authentication.  Note that the following list is non- exhaustive: </ins> Device-to-device communication with out-of-band synchronized keys. PSKs provisioned out-of-band for communicating with known with fast open (0-RTT data). Internet of Things (IoT) and devices with limited computational  <ins> capabilities.  RFC7925 defines TLS and DTLS profiles for resource- constrained devices and suggests the use of PSK ciphersuites for compliant devices. Use of PSK ciphersuites are optional when securing RADIUS RFC2865 with TLS as specified in RFC6614. The Generic Authentication Architecture (GAA) defined by 3GGP </ins> mentions that TLS-PSK can be used between a server and user  <ins> equipment for authentication GAA. </ins> Smart Cards.  The electronic German ID (eID) card supports  <ins> authentication of a card holder to online services with TLS-PSK SmartCard. </ins> There are also use cases where PSKs are shared between more than two  <ins> entities.  Some examples below (as noted by Akhmetzyanova et al.Akhmetzyanova): </ins>  <ins> Group chats.  In this use-case, the membership of a group is </ins> confirmed by the possession of a PSK distributed out-of-band to the group participants.  Members can then establish peer-to-peer connections with each other using the external PSK.  It is 3.1. Many industrial protocols assume that PSKs are distributed and  <ins> assigned manually via one of the following approaches: typing the PSK into the devices, or via web server masks (using a Trust On First Use (TOFU) approach with a device completely unprotected before the first login did take place).  Many devices have very limited UI.  For example, they may only have a numeric keypad or even less number of buttons.  When the TOFU approach is not suitable, entering the key would require typing it on a constrained UI.  Moreover, PSK production lacks guidance unlike user passwords. </ins> Some devices are provisioned PSKs via an out-of-band, cloud-based syncing protocol. Secrets may be baked into or hardware or software device  <ins> components, such as secure enclaves. </ins> 3.2. another example, some systems require the provisioning process to embed application-specific information in either PSKs or their identities.  Identities may sometimes need to be routable, as is  <ins> currently under discussion for EAP-TLS-PSK. </ins> 3.3. 5.  <ins> The TLS external PSK authentication makes the implicit assumption that each PSK is known only to one client and one server, which do not switch roles with the same PSK. As discussed in use-cases, there are use cases where multiple clients or multiple servers share a PSK.  In such cases, TLS only authenticates the entire group.  Not only can a compromised group member impersonate another group member, but a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways.  This rerouting is a type of identity misbinding attack Sethi. Selfie attack Selfie is a special case of the rerouting attack against a group member that can act both as TLS server and client. In the selfie attack, a malicious non-member reroutes a connection from the client to the server on the same endpoint. </ins> 6.


Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH <del> exchange for forward secrecy.  As discussed in sec-properties, low entropy PSKs, i.e., those derived from less than 128 bits of entropy, are subject to attack and SHOULD be avoided.  If only low-entropy keys are available, then key establishment mechanisms such as Password Authenticated Key Exchange (PAKE) that mitigate the risk of offline dictionary attacks SHOULD be employed.  Note that these mechanisms do not necessarily follow the same architecture as the ordinary process for incorporating EPSKs described in this draft. </del>  Unless other accommodations are made, each PSK MUST be restricted in its use to at most two logical nodes: one logical node in a TLS the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for <del> any operation.  TLS version 1.3 RFC8446 follows the same practice of specifying the PSK identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1> in the specification).  RFC8446 also requires that the PSK identities are at least 1 byte and at the most 65535 bytes in length.  Although RFC8446 does not place strict requirements on the format of PSK identities, we do however note that the format of PSK identities can vary depending on the deployment: </del>  The PSK identity MAY be a user configured string when used in protocols like Extensible Authentication Protocol (EAP) RFC3748.

Closes Issues and .
NAME does this address your comments in ?
Yep, looks great!
(This question is copied from my email with greater context from the draft.) Section 7.1 is the following: "Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH exchange for forward secrecy. As discussed in Section 4, low entropy PSKs, i.e., those derived from less than 128 bits of entropy, are subject to attack and SHOULD be avoided. If only low-entropy keys are available, then key establishment mechanisms such as Password Authenticated Key Exchange (PAKE) that mitigate the risk of offline dictionary attacks SHOULD be employed. Note that these mechanisms do not necessarily follow the same architecture as the ordinary process for incorporating EPSKs described in this draft." Where was the ordinary process for incorporating EPSKs described? Is "incorporating" a PSK the same as "provisioning" one? If so, several ways were described. What's the problem with these mechanisms (e.g. PAKE) having a different architecture from these ordinary processes? Are they not compatible?
Perhaps this refers to the process in I-D.ietf-tls-external-psk-importer, which takes a provisioned PSK and performs a transformation on it to ensure that it is unique? That can then be incorporated into the key schedule. This is different from the PAKE process, which doesn't pass through the ePSK importer mechanism. Not sure if that was the original intention, but if so we should write clarifying text.
From : Good suggestion. Let's clarify! My interpretation was that it speaks of the future :-) We can clarify this. That seems reasonable. I'll propose text. Dear WG, I've taken a look at the draft and I think while its discussion of the properties and limitations of the external PSKs are good, I think the recommendations in section 7 could use some minor editorial work. In particular "SHOULD be combined with a DH exchange for forward secrecy." I would like to see rephrased to make clear that this is about the TLS PSK Key Exchange Mode. It wasn't immediately clear to me on first read, especially given the next sentence is (maybe) about key establishment outside of TLS. "If only low-entropy keys are available, then key establishment mechanisms such as Password Authenticated Key Exchange (PAKE) that mitigate the risk of offline dictionary attacks SHOULD be employed". I have some questions about the meaning of this sentence. If it's about potential future additions to TLS ciphersuites, then it should be more clear that this doesn't currently exist and will in the future. If it's about designing an ad-hoc key distribution mechanism to be run one time ahead of PSK TLS, then I think we should say so more clearly and provide guidance on how to do this and think through the implications. Section 7.1.1. While it's a good idea to compare byte by byte, humans entering PSK identifiers may run into trouble due to all the ways visually identical strings may not actually be identical. It might be worth calling this out as a consideration. Sincerely, Watson Ladd

Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH  <ins> exchange, e.g., by using the "psk_dhe_ke" Pre-Shared Key Exchange Mode in TLS 1.3, for forward secrecy.  As discussed in sec- properties, low entropy PSKs, i.e., those derived from less than 128 bits of entropy, are subject to attack and SHOULD be avoided. If only low-entropy keys are available, then key establishment mechanisms such as Password Authenticated Key Exchange (PAKE) that mitigate the risk of offline dictionary attacks SHOULD be employed.  Note that no such mechanisms have yet been standardised, and further that these mechanisms will not necessarily follow the same architecture as the process for incorporating EPSKs described in I-D.ietf-tls-external-psk- importer. </ins> Unless other accommodations are made, each PSK MUST be restricted in its use to at most two logical nodes: one logical node in a TLS the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for  <ins> any operation.  When PSK identites are configured manually it is important to be aware that due to encoding issues visually identical strings may, in fact, differ. TLS version 1.3 RFC8446 follows the same practice of specifying the PSK identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1> in the specification).  RFC8446 also requires that the PSK identities are at least 1 byte and at the most 65535 bytes in length.  Although RFC8446 does not place strict requirements on the format of PSK identities, we do however note that the format of PSK identities can vary depending on the deployment: </ins> The PSK identity MAY be a user configured string when used in protocols like Extensible Authentication Protocol (EAP) RFC3748.


entities.  Some examples below (as noted by Akhmetzyanova et al.Akhmetzyanova): <del> Group chats.  In this use-case, the membership of a group is confirmed by the possession of a PSK distributed out-of-band to the group participants.  Members can then establish peer-to-peer connections with each other using the external PSK.  It is important to note that any node of the group can behave as a TLS client or server. Internet of Things (IoT).  In this use-case, resource-constrained IoT devices act as TLS clients and share the same PSK.  The devices use this PSK for quickly establishing connections with a central server.  Such a scheme ensures that the client IoT devices are legitimate members of the system.  To perform rare system specific operations that require a higher security level, the central server can request resource-intensive client authentication with the usage of a certificate after successfully establishing the connection with a PSK. </del>  6.1.

, and .
NAME does this address your (other) comments?
I think this adds really helpful context to what would otherwise be confusing on its own, thanks.
(Also adding this question from the email.) The draft states: "PSK provisioning systems are often constrained in application-specific ways. For example, although one goal of provisioning is to ensure that each pair of nodes has a unique key pair, some systems do not want to distribute pair-wise shared keys to achieve this." Why wouldn't a system want to distribute pair-wise keys? What application-specific constraint would warrant that? (I'm imagining, for instance, that maybe that would overload the network or something, but the reason should probably be explained rather than left to the imagination.)
NAME can you please take this?
This text is based on the input from Björn Haase. Essentially, he indicated that some industrial control deployments do not want to have O(n^2) keys for a system with n nodes, but they do want to minimize sharing. I am fine with changing it to "might not want to" or removing this constraint completely. Also answered on the mailing list here: URL
Ah, that seems like an important point to mention. It makes sense that provisioning O(n^2) keys would be overburdensome on a system, but if it doesn't, there are security trade-offs, right?
Yep. NAME what sort of change are you looking for here?
NAME change works for me.
(This question is copied from my email.) The draft states: "In this use-case, resource-constrained IoT devices act as TLS clients and share the same PSK. The devices use this PSK for quickly establishing connections with a central server. Such a scheme ensures that the client IoT devices are legitimate members of the system." If the IoT devices only talk to a central server and not each other, why do they all need the same PSK? That doesn't seem like a good idea, given that the clients can then impersonate each other and listen in on each other's traffic.
NAME can you please take this?
The explanation in URL doesn't address why it's okay or desirable for all the clients to have the same PSK. The clients are constrained, being IoT devices, but the server isn't, and presumably can handle n PSKs for n clients.
The best argument I can come up with for why a server might want all devices to have the same key is if there are many devices and a high rate of turnover. Rather than trying to keep track of rapidly changing list of keys, perhaps it is easier to just use a single key, especially if there is a high penalty if a device is unable to connect. Further, if the devices have a way of upgrading to a more secure connection when necessary, then the central server may not care if devices can impersonate one another. Not sure it's very convincing, but perhaps at least plausible?
I don't think we need to rationalize the use case. The point of this section is to document known use cases, not justify them, and to provide recommendations for using PSKs in such circumstances. NAME I'm not sure what action you're looking for here. Justification is out of scope, I think.
You can close this then, since this relates to the discussion elsewhere about justification.
(This question is copied from my email.) The draft states: "To perform rare system specific operations that require a higher security level, the central server can request resource-intensive client authentication with the usage of a certificate after successfully establishing the connection with a PSK." If you're going to authenticate with a cert, why bother preceding that with an authentication with a PSK?
NAME can you please take this?
and this refer to the same use-case and can be merged. This use-case is described in the publication by Akhmetzyanova et al. URL See section 4. In the scenario described by the authors, resource-constrained IoT devices are TLS clients. The PSK is used for authenticating the central server and client membership of the system. Only for rare device-specific operations requiring a higher-security level (such as device firmware update), the server can request resource-intensive client authentication with certificates after successfully establishing the connection with PSK. This deployment may seem somewhat artificial but it was necessary in the paper to explain the possible attack scenarios. Also answered on the mailing list here: URL
That rephrases the content in the draft; I guess what I'm asking for is a brief explanation as to why authenticating the client with a certificate is necessary to circumvent those attack scenarios. Hi Carrick, Thank you for the review. I also added some comments in-line. On 8/18/20 6:26 PM, Christopher Wood wrote: This use-case is described in the publication by Akhmetzyanova et al. URL See section 4. In the scenario described by the authors, resource-constrained IoT devices are TLS clients. The PSK is used for authenticating the central server and client membership of the system. Only for rare device-specific operations requiring a higher-security level (such as device firmware update), the server can request resource-intensive client authentication with certificates after successfully establishing the connection with PSK. This deployment may seem somewhat artificial but it was necessary in the paper to explain the possible attack scenarios. This text is based on the input from Björn Haase. Essentially, he indicated that some industrial control deployments do not want to have O(n^2) keys for a system with n nodes, but they do want to minimize sharing. I am fine with changing it to "might not want to" or removing this constraint completely. A citation for EAP-TLS-PSK is added in the github version of the document. I agree that "routable" identities is not something obvious and could be better explained. In standard AAA (Authentication, Authorization and Accounting) architecture, client devices send an identity for network access authentication. These identities are in the form of a Network Access Identifier (define in RFC 7542: URL). Nodes in the network such as access points (also called as authenticators) look at the identity (mostly the domain name suffix at the end of the identity) to determine if they should proceed with the authentication request and for figuring out the appropriate EAP server where the authentication request should be sent. Perhaps that sentence could be re-written as: "PSK identities may sometimes need to have a domain name suffix, as is currently under discussion for EAP-TLS-PSK [I-D.mattsson-emu-eap-tls-psk]". I didn't find any standard definition of federation even though many RFCs have used them in the past (RFCs 2552,3313,7532). We could add a reference to roaming defined in RFC 2904: URL and drop federation. Would that work? --Mohit

entities.  Some examples below (as noted by Akhmetzyanova et al.Akhmetzyanova):  <ins> Group chats.  In this use-case, group participants may be provisioned an external PSK out-of-band for establishing authenticated connections with other members of the group. Internet of Things (IoT) and devices with limited computational capabilities.  Many PSK provisioning examples are possible in this use-case.  For example, in a given setting, IoT devices may all share the same PSK and use it to communicate with a central server (one key for n devices), have their own key for communicating with a central server (n keys for n devices), or have pairwise keys for communicating with each other (n^2 keys for n devices). The exact provisioning process depends on the system requirements and threat model.  Generally, use of a single PSK shared between more than one node is not recommended, even if other accommodations are made, such as client certificate authentication after PSK-based connection establishment.  See recommendations. </ins> 6.1.


See the Security Considerations in I-D.ietf-tls-external-psk- importer for more information. <del> Where possible the master PSK (that which is fed into the importer) SHOULD be deleted after the imported keys have been generated.  This protects an attacker from bootstrapping a compromise of one node into the ability to attack connections between any node; otherwise the attacker can recover the master key and then re-run the importer itself. </del>  7.1.

s7 includes the following and in light of 8446bis we should probable replace "master": Where possible the master PSK (that which is fed into the importer) SHOULD be deleted after the imported keys have been generated. This protects an attacker from bootstrapping a compromise of one node into the ability to attack connections between any node; otherwise the attacker can recover the master key and then re-run the importer itself.

See the Security Considerations in I-D.ietf-tls-external-psk- importer for more information.  <ins> Where possible the main PSK (that which is fed into the importer) SHOULD be deleted after the imported keys have been generated. This protects an attacker from bootstrapping a compromise of one node into the ability to attack connections between any node; otherwise the attacker can recover the main key and then re-run the importer itself. </ins> 7.1.


Most major TLS implementations support external PSKs.  Stacks supporting external PSKs provide interfaces that applications may use <del> when supplying them for individual connections.  Details about </del>  existing stacks at the time of writing are below. OpenSSL and BoringSSL: Applications can specify support for the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for <del> any operation.  When PSK identites are configured manually it is </del>  important to be aware that due to encoding issues visually identical strings may, in fact, differ. gnuTLS for example treats PSK identities as usernames. PSK identities MAY have a domain name suffix for roaming and <del> federation. </del>  Deployments should take care that the length of the PSK identity is sufficient to avoid collisions. It is possible, though unlikely, that an external PSK identity may clash with a resumption PSK identity.  The TLS stack implementation <del> and sequencing of PSK callbacks influences the application's behaviour when identity collisions occur.  When a server receives a PSK identity in a TLS 1.3 ClientHello, some TLS stacks execute the </del>  application's registered callback function before checking the stack's internal session resumption cache.  This means that if a PSK identity collision occurs, the application will be given precedence

cc NAME NAME
In section 4 there is a statement that switching the roles of servers which use PSKs will lead to weakening of security properties. As this is a common scenario today in situations where you are doing server-to-server communication, it would be useful to discuss just how and how much this weakening occurs. This was a complete surprise to me and I don't know if it was supposed to be one. Are there mitigations that can be made? In section 7, The first sentence does not read, also It seems a bit difficult to have a MUST in there when most of the items below are SHOULDs. That seems to be a dissonance. Section 7.1.1 - The idea of having domain name suffixes on PSKs seems to me to be a bad idea as this would seem to lower privacy levels. Section 7.1.2 - There seem to me to be three different places where collisions will occur. The importer function could get a collision, there could be collisions with pre-TLS 1.2 external identifiers and there could be collision with resumption keys. There has been a huge discussion about this in the EMU group and I don't find the text here to be sensible in term of whether this is or is not a problem. Section 7.1.2 - One of the things that I kept meaning to get to and just haven't done so yet, is dealing with the question of can the TLS Key binders in the handshake to distinguish between multiple keys that happen to have the same identity. Perhaps you should look to see if this does work and if it is safe.

Most major TLS implementations support external PSKs.  Stacks supporting external PSKs provide interfaces that applications may use  <ins> when configuring PSKs for individual connections.  Details about </ins> existing stacks at the time of writing are below. OpenSSL and BoringSSL: Applications can specify support for the identity is configured by human users).  On the other hand, RFC7925 advises implementations against assuming any structured format for PSK identities and recommends byte-by-byte comparison for  <ins> any operation.  When PSK identities are configured manually it is </ins> important to be aware that due to encoding issues visually identical strings may, in fact, differ. gnuTLS for example treats PSK identities as usernames. PSK identities MAY have a domain name suffix for roaming and  <ins> federation.  In applications and settings where the domain name suffix is privacy sensitive, this practice is NOT RECOMMENDED. </ins> Deployments should take care that the length of the PSK identity is sufficient to avoid collisions. It is possible, though unlikely, that an external PSK identity may clash with a resumption PSK identity.  The TLS stack implementation  <ins> and sequencing of PSK callbacks influences the application's behavior when identity collisions occur.  When a server receives a PSK identity in a TLS 1.3 ClientHello, some TLS stacks execute the </ins> application's registered callback function before checking the stack's internal session resumption cache.  This means that if a PSK identity collision occurs, the application will be given precedence


cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions.  1. 4. <del> The external PSK authentication mechanism in TLS implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened. </del>  As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers to share a PSK.  If this is Any group member can impersonate any other group member. <del> If a group member is compromised, then the attacker can impersonate any group member (this follows from property (1)). </del>  If PSK without DH is used, then compromise of any group member <del> allows the attacker to passively read all traffic. </del>  <del> In addition to these, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as detailed below.  (Note that this class of attack is not possible if each member uses the SNI extension RFC6066 and terminates the connection on mismatch.  See Selfie for details.) </del>  <del> Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows: </del>  "A" sends a "ClientHello" to "B". non-member reroutes a connection from the client to the server on the same endpoint.  Entropy properties of external PSKs may also affect TLS security properties.  In particular, if a high entropy PSK is used, then PSK- only key establishment modes are secure against both active and exchange.  Low entropy keys are only secure against active attack if a PAKE is used with TLS.  The Crypto Forum Research Group (CFRG) is currently working on specifying a standard PAKE (see I-D.irtf-cfrg- <del> cpace and I-D.krawczyk-cfrg-opaque). </del>  5. information about the external PSK or its identifier by virtue of it appearing in cleartext in a ClientHello.  As a result, a passive adversary can link two or more connections together that use the same <del> external PSK on the wire.  Techniques for mitigating these risks require analysis and are out of scope for this document. </del>  In addition to linkability in the network, external PSKs are intrinsically linkable by PSK receivers.  Specifically, servers can authentication of a card holder to online services with TLS-PSK SmartCard.  There are also use cases where PSKs are shared between more than two entities.  Some examples below (as noted by Akhmetzyanova et al.Akhmetzyanova):

Builds on , and , and . cc NAME NAME NAME -- please review so we can submit today!
There are two numbered lists both of which only seem to have 1s? I see that you have removed the text on security weaknesses of PSKs (lack of identity protection/forward secrecy etc.) and also removed the reference to RFC 8773. I am completely fine with both as long as we provide a convincing answer to John's review.
Markdown handles the numbering for us. We have a section on identity protection, and the recommendations discuss forward secrecy, so I think more is redudant. No, that's still there.
John wrote: There also several weaknesses/limitation that are hinted at in RFC 8446 which apply for two-party PSK authenticated connections. As this is a guidance document for all uses of external PSK, I think this document should bring up and expand upon: Key Compromise Impersonation (KCI) resistance Protection of endpoint identities Forward secret with respect to long-term keys (psk_ke only) An additional security property given by signature authentication but not psk authentication is non-repudiation. As stated by Wikipedia “By this property, an entity that has signed some information cannot at a later time deny having signed it.”
This is a fair comment and I don't see any reason not to add these
NAME can you please send a PR?
Closing as resolved (by ).
The draft says “OpenSSL and BoringSSL: Applications specify support for external PSKs via distinct ciphersuites.” John wrote: I assume this is not the case for TLS 1.3 as the cipher suites in TLS 1.3 are independent of the authentication.
I guess it would help to clarify. In my opinion, we should only look at APIs of TLS 1.3.
I fixed this directly on main.
The draft currently says "It is NOT RECOMMENDED to share the same PSK between more than one client and server." John says: group PSK violates both “peer authentication” and “downgrade protection property”. It also violates “secrecy of the session keys”. Two-party PSK already does not provide “Key Compromise Impersonation (KCI) resistance” and “Protection of endpoint identities” and pskkey does not provide “Forward secret with respect to long-term keys”. So when pskke is used in a group, the only property left is “Uniqueness of the session keys”...I am skeptical to introduce this new group PSK mode in an informal guidance document. If group PSK should be allowed, it should be more clearly declared as a new mode of TLS 1.3 and the security properties given and not given should be more clearly stated.
I guess John thinks NOT RECOMMENDED is not sufficient and we should stronger language like SHALL NOT.

cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions. <ins> Privacy and security properties not provided by PSKs are also included. </ins> 1. 4.  <ins> External PSK authentication in TLS allows endpoints to authenticate connections using previously established keys.  These keys do not provide protection of endpoint identities (see endpoint-privacy), nor do they provide non-repudiation (one endpoint in a connection can deny the conversation).  PSK authentication security implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened. </ins> As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers to share a PSK.  If this is Any group member can impersonate any other group member.  <ins> If PSK with DH is used, then compromise of a group member that actively completes connections with other group members can read (and modify) traffic. </ins> If PSK without DH is used, then compromise of any group member  <ins> allows the attacker to passively read (and modify) all traffic. </ins>  <ins> If a group member is compromised, then the attacker can perform all of the above attacks. </ins>  <ins> Additionally, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as described below.  (Note that this class of attack is not possible if each member uses the SNI extension RFC6066 and terminates the connection on mismatch.  See Selfie for details.)  Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows: </ins> "A" sends a "ClientHello" to "B". non-member reroutes a connection from the client to the server on the same endpoint. <ins> Finally, in addition to these weaknesses, sharing a PSK across nodes may negatively affects deployments.  For example, revocation of individual group members is not possible without changing the authentication key for all members. </ins> Entropy properties of external PSKs may also affect TLS security properties.  In particular, if a high entropy PSK is used, then PSK- only key establishment modes are secure against both active and exchange.  Low entropy keys are only secure against active attack if a PAKE is used with TLS.  The Crypto Forum Research Group (CFRG) is currently working on specifying a standard PAKE (see I-D.irtf-cfrg-  <ins> cpace and I-D.irtf-cfrg-opaque). </ins> 5. information about the external PSK or its identifier by virtue of it appearing in cleartext in a ClientHello.  As a result, a passive adversary can link two or more connections together that use the same  <ins> external PSK on the wire.  Depending on the PSK identity, a passive attacker may also be able to identify the device, person, or enterprise running the TLS client or TLS server.  An active attacker can also use the PSK identity to oppress handshakes or application data from a specific device by blocking, delaying, or rate-limiting traffic.  Techniques for mitigating these risks require analysis and are out of scope for this document. </ins> In addition to linkability in the network, external PSKs are intrinsically linkable by PSK receivers.  Specifically, servers can authentication of a card holder to online services with TLS-PSK SmartCard. <ins> Quantum resistance: Some deployments may use PSKs (or combine them with certificate-based authentication as described in RFC8773) because of the protection they provide against quantum computers. </ins> There are also use cases where PSKs are shared between more than two entities.  Some examples below (as noted by Akhmetzyanova et al.Akhmetzyanova):


Abstract This document provides usage guidance for external Pre-Shared Keys <del> (PSKs) in TLS.  It lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks.  This document also discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions. Privacy and security properties not provided by PSKs are also included. </del>  1.  There are many resources that provide guidance for password generation and verification aimed towards improving security. However, there is no such equivalent for external Pre-Shared Keys <del> (PSKs) in TLS.  This document aims to reduce that gap.  It lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks. This document also discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions. </del>  The guidance provided in this document is applicable across TLS RFC8446, DTLS I-D.ietf-tls-dtls13, and Constrained TLS I-D.ietf-tls- The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and <del> "OPTIONAL" in this document are to be interpreted as described in BCP 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here. </del>  3. connections using previously established keys.  These keys do not provide protection of endpoint identities (see endpoint-privacy), nor do they provide non-repudiation (one endpoint in a connection can <del> deny the conversation).  PSK authentication security implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened. </del>  4.1. As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers to share a PSK.  If this is <del> done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall </del>  system is inherently rather brittle.  There are a number of obvious weaknesses here: Additionally, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as described <del> below.  (Note that this class of attack is not possible if each member uses the SNI extension RFC6066 and terminates the connection on mismatch.  See Selfie for details.)  Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows: </del>  "A" sends a "ClientHello" to "B". Finally, in addition to these weaknesses, sharing a PSK across nodes may negatively affect deployments.  For example, revocation of <del> individual group members is not possible without changing the authentication key for all members. </del>  4.2.

Resolve comments from Ben Smyth.
NAME can you please cut a new version of the draft?
Done. Revision -02 has been submitted.
I am getting a permission error when I try to set the tag for "draft-ietf-tls-external-psk-guidance-02". Everything else is done, and I have used my local file to submit the Internet-Draft. Please set the tag when you have a minute.

Abstract This document provides usage guidance for external Pre-Shared Keys  <ins> (PSKs) in Transport Layer Security (TLS) version 1.3 as defined in RFC 8446.  It lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks.  It discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions.  It also lists the privacy and security properties that are not provided by TLS when external PSKs are used. </ins> 1. <ins> This document provides guidance on the use of external Pre-Shared Keys (PSKs) in Transport Layer Security (TLS) version 1.3 RFC8446. This document lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks.  This document discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  This document also provides advice for applications in various use cases to help meet these assumptions. </ins> There are many resources that provide guidance for password generation and verification aimed towards improving security. However, there is no such equivalent for external Pre-Shared Keys  <ins> (PSKs) in TLS.  This document aims to reduce that gap. </ins> The guidance provided in this document is applicable across TLS RFC8446, DTLS I-D.ietf-tls-dtls13, and Constrained TLS I-D.ietf-tls- The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and  <ins> "OPTIONAL" in this document are to be interpreted as described in BCP 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here. </ins> 3. connections using previously established keys.  These keys do not provide protection of endpoint identities (see endpoint-privacy), nor do they provide non-repudiation (one endpoint in a connection can  <ins> deny the conversation).  Protection of endpoint identities and protection against an endpoint denying the conversation are possible when a fresh TLS handshake is performed. PSK authentication security implicitly assumes one fundamental property: each PSK is known to exactly one client and one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened as discussed below. </ins> 4.1. As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers to share a PSK.  If this is  <ins> done naively by having all members share a common key, then TLS authenticates only group membership, and the security of the overall </ins> system is inherently rather brittle.  There are a number of obvious weaknesses here: Additionally, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as described  <ins> below.  Note that this class of attack is not possible if each member uses the SNI extension RFC6066 and terminates the connection on mismatch.  See Selfie for details. To illustrate the rerouting attack, consider the group of peers who know the PSK be "A", "B", and "C".  The attack proceeds as follows: </ins> "A" sends a "ClientHello" to "B". Finally, in addition to these weaknesses, sharing a PSK across nodes may negatively affect deployments.  For example, revocation of  <ins> individual group members is not possible without changing establishing a new PSK for all of the non-revoked members. </ins> 4.2.