Conversation
reneme
left a comment
There was a problem hiding this comment.
Self-review. We'll address those issues (+ the currently failing CI) today. External PSK should then be finished from our side.
2201d0b to
4c5d0bf
Compare
Co-Authored-By: Fabian Albert <fabian.albert@rohde-schwarz.com>
|
Rebased after #3622 was merged. As mentioned in the PR description, most of this patch adds details to manage PSKs and let them co-exist with sessions during the early stages of the handshake. Along with the introduction of the public API |
randombit
left a comment
There was a problem hiding this comment.
Looks very good.
I'd like to see at least one C++ test since IIUC we are currently only testing this functionality with the cli, which seems not great.
Mhm, that bugged me as well. Especially, since we're just doing a round-trip test in CLI against our own implementation. If we break something along the way, chances are that we would stay compatible with ourselves but not with the outside world. 😨 Unfortunately, neither BoGo nor RFC8448 provide tests for externally provided PSK. And just implementing another round-trip test in C++ didn't seem like a big win to me. Suggestion: Let's generate our own RFC8448-ish test vector and freeze it in a |
Done. This worked surprisingly smoothly by hacking the CLI-based roundtrip test we had implemented already. For future reference:
I've created a temporary branch with the hacked bits. This might come in handy if we want to repeat this exercise for |
|
Thanks for adding the new tests @reneme |
Pull Request Dependencies
[TLS 1.3] Preparations for externally provided PSKs #3617[TLS 1.3] Extend CredentialsManager for upcoming TLS 1.3 PSK #3622Description
This adds support for externally provisioned PSKs in TLS 1.3. Note that currently, only the
PSK_DHE_KEmode is implemented.PSK_KEis left as future-work, same with 0-RTT/early data support.External PSKs are provided by deriving the
Credentials_Managerand overriding at least thefind_preshared_keys()method. For fine-grained control, applications should additionally overridechoose_preshared_key().Note that the low-level key derivation machinery for PSK support was already implemented due to the existing TLS 1.3 resumption support. Most of this pull request is focussing on managing the offering and choosing of the PSK(s) during the early negotiation.
Tests
Unfortunately, BoGo doesn't come with PSK tests for TLS 1.3 (yet?). We added an integration test in
test_cli.pythat performs a PSK-based handshake between a botan-cli client and server. Additionally we sucessfully confirmed compatibility withopenssl s_clientandgnutls-cliboth in TLS 1.2 and 1.3.