Draft: draft-group-tls-external-psk-guidance

Commentary: of key sharing and less on whether the 7 security guarantees are met .
Paragraph (version A):
Key Compromise Impersonation (KCI) resistance.
Paragraph (version A):
To achieve these properties, the external PSK authentication
mechanism implicitly assumes one fundamental property: each PSK is
known to exactly one client and one server, and that these never
switch roles.  If this assumption is violated, standard TLS 1.3
security properties are invalidated.  Section violations discusses
attacks that are possible when this occurs.
Paragraph (version A):
In the following sub-sections, we list attacks that demonstrate
violations of these properties when the fundamental PSK assumption
does not hold.
Paragraph (version A):
This attack simply requires the adversary to reroute messages without
changing any of their contents.
Paragraph (version B):
The external PSK authentication mechanism in TLS implicitly assumes
one fundamental property: each PSK is known to exactly one client and
one server, and that these never switch roles.  If this assumption is
violated, then the security properties of TLS are severely weakened.
Paragraph (version B):
Any group member can impersonate any other group member.
Paragraph (version B):
If a group member is compromised, then the attacker can
impersonate any group member (this follows from property (1)).
Paragraph (version B):
If PSK without DH is used, then compromise of any group member
allows the attacker to passively read all traffic.
Paragraph (version B):
In addition to these, a malicious non-member can reroute handshakes
between honest group members to connect them in unintended ways, as
detailed below.
Paragraph (version A):
If the client performs a PSK-based handshake without a DHE exchange,
then another trivial attack is possible.
Paragraph (version A):
"A" sends a "ClientHello" to "B", without including a key share
extension.
Paragraph (version A):
The handshake completes as expected.
Paragraph (version A):
This attack violates the secrecy of session keys property, because
even an honest but curious "C" can decrypt the session between "A"
and "B".  This attack also violates forward secrecy, because a future
compromise of "C" reveals the contents of the session, however
RFC8446 notes that PSK-based handshakes without a fresh DHE do not
achieve this property.
Paragraph (version A):
If the attacker compromises a client or server then the session is
definitionally insecure, however sharing the key with more than one
client and one server means that compromise of a different actor can
lead to attacks.
Paragraph (version A):
Let the attacker compromise "C".
Paragraph (version A):
"A" sends a "ClientHello" to "B".
Paragraph (version A):
The attacker intercepts the message and creates a new
"ClientHello".
Paragraph (version A):
The attacker sends the new "ClientHello" to "B".
Paragraph (version A):
"B" responds to "A".
Paragraph (version A):
The attacker intercepts the message and creates a new response.
Paragraph (version A):
The attacker sends the new response to "A".
Paragraph (version A):
"A" sends a "Finished" message to "B".  "A" has completed the
handshake, ostensibly with "B".
Paragraph (version A):
The attacker intercepts the "Finished" message and creates a new
"Finished" message.
Paragraph (version A):
The attacker sends the new "Finished" message to "B".  "B" has
completed the handshake, ostensibly with "A".
Paragraph (version A):
This attack, and minor variants of it, violate the remaining
properties outlined above.  The attack violates the same session keys
property, as "A" and "B" have each completed a session, ostensibly
with each other, and yet do not agree on the session key.  If "A"
does not send a key share extension, then the attacker can have a
session with "A" and a separate session with "B", where both sessions
have the same key.  Since the attacker has knowledge of all of the
messages and their content, the nonce in the handshake does not
prevent the attacker from computing the full key schedule.  This
violates the uniqueness of session keys property.  In the case of KCI
resistance, where we assume the attacker has compromised "A", the
attacker can successfully impersonate "B" to "A" using this pattern.