Original text:
one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened. <del> As discussed in use-cases, there are use cases where it is desirable for multiple clients or multiple servers share a PSK.  If this is done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall system is inherently rather brittle.  There are a number of obvious weaknesses here: </del>  Any group member can impersonate any other group member. non-member reroutes a connection from the client to the server on the same endpoint.  4. <del> Applications MUST use external PSKs that adhere to the following requirements: </del>  <del> Each PSK MUST be derived from at least 128 of entropy and MUST be at least 128-bits long unless the TLS handshake is being used with a separate key establishment mechanism such as a Diffie-Hellman exchange.  This recommendation protects against passive attacks using exhaustive search of the PSK. </del>  Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a

Reviewer comments:
Discuss the different variants: High entropy PSK+DH High entropy PSK-only Low PSK with strong (balanced) PAKE ... and their security properties. For encodings, mention RFC1751 and Bjorn's draft.
Proposed text: If a high entropy PSK is used, then PSK-only key establishment modes are secure against both active and passive attack, but will not enjoy forward security. Forward security may be achieved by using a PSK-DH mode. If a low entropy PSK is used, then PSK-only key establishment modes are subject to passive exhaustive search passive attacks which will reveal the traffic keys. PSK-DH modes are subject to active attacks in which the attacker impersonates one side. The exhaustive search phase of these attacks can be mounted offline if the attacker captures a single handshake using the PSK, but those attacks will not lead to compromise of the traffic keys for that connection because those also depend on the DH exhange. Low entropy keys are only secure against active attack if a PAKE is used with TLS.

Revised text:
one server, and that these never switch roles.  If this assumption is violated, then the security properties of TLS are severely weakened.  <ins> use-cases discusses use cases where it is desirable for multiple clients or multiple servers share a PSK.  If this is done naively by having all members share a common key, then TLS only authenticates the entire group, and the security of the overall system is inherently rather brittle.  There are a number of obvious weaknesses here: </ins> Any group member can impersonate any other group member. non-member reroutes a connection from the client to the server on the same endpoint. <ins> Entropy properties of external PSKs may also affect TLS security properties.  In particular, if a high entropy PSK is used, then PSK- only key establishment modes are secure against both active and passive attack.  However, they lack forward security.  Forward security may be achieved by using a PSK-DH mode. In contrast, if a low entropy PSK is used, then PSK-only key establishment modes are subject to passive exhaustive search passive attacks which will reveal the traffic keys.  PSK-DH modes are subject to active attacks in which the attacker impersonates one side.  The exhaustive search phase of these attacks can be mounted offline if the attacker captures a single handshake using the PSK, but those attacks will not lead to compromise of the traffic keys for that connection because those also depend on the Diffie-Hellman (DH) exchange.  Low entropy keys are only secure against active attack if a PAKE is used with TLS. </ins> 4.  <ins> Applications MUST adhere to the following requirements for external PSKs: </ins>  <ins> Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with a DH exchange for forward secrecy.  Low entropy PSKs, i.e., those derived from less than 128 bits of entropy, MUST be combined with a Password Authenticated Key Exchange (PAKE) mechanism. </ins> Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a