Subject: [TLS] PR#962:CertificateRequest in post-handhake phase

From: Eric Rescorla <[email-masked]>
Date: Tue, 18 Apr 2017 09:48:33 -0400

https://github.com/tlswg/tls13-spec/pull/962
Target merge date: Thursday

In reviewing the specification, I noticed that we seem to have banned the
use of CertificateRequest with PSK both in the main handshake and in the
post-handshake phase. I don't believe that this was intentional and it
makes it very hard to use client auth with resumption. Accordingly I have
filed the above PR to remove that restriction (while retaining it for the
main handshake). As I understand it, several of the analyses we have
already assumed this case and covered it, so no additional work is needed
there.

Comments/Objections welcome.
-Ekr

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 18 Apr 2017 22:41:34 +0300

> already assumed this case and covered it, so no additional work is needed

On topic of PSKs, I noticed that TLS 1.3 makes it very easy to mount
dictionary attacks against PSK, regardless of DHE-PSK (especially to
recover the client PSK). I assumed that the document already documents
this, but I couldn't find any remark that using low-entropy PSKs is very
bad idea.

IIRC, the TLS 1.0-1.2 PSK RFC does discuss dictionary attacks a bit.

-Ilari

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 18 Apr 2017 15:51:53 -0400

> this, but I couldn't find any remark that using low-entropy PSKs is very

Good point. As far as I can tell...

1. You can search the binder.
2. Because we forbid PSK with server authentication, you can also
impersonate the server and then mount a dictionary attack (even w/o the
binder).

I agree that this should be documented. I filed
https://github.com/tlswg/tls13-spec/issues/965 so we don't forget this.
I'll take a PR if you have one.

Yes, it does. Someone could crib from that....

-Ekr

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 18 Apr 2017 23:44:02 +0300

> impersonate the server and then mount a dictionary attack (even w/o the

AFAICT, if I wanted to extract low-entropy client PSK, I wouldn't even
bother with 2, since 1 seems so much more efficient (all passive too!)..

Also, wonder if there are efficient ways of probing server PSKs (I
didn't compe up with one, even in pure-PSK, due to binders making
such probing nontrivial).

-Ilari

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 18 Apr 2017 16:46:20 -0400

> bother with 2, since 1 seems so much more efficient (all passive too!)..

I agree. I just meant that if we were to dispense with the binder it would
still be trivial.

-Ekr