Draft: draft-ietf-tls-external-psk-guidance

Commentary: Resolve comments from   . 
 can you please cut a new version of the draft ? 
 Done . Revision -02 has been submitted . 
 I am getting a permission error when I try to set the tag for " draft - ietf - tls - external - psk - guidance-02 " . Everything else is done , and I have used my local file to submit the Internet - Draft . Please set the tag when you have a minute .
Paragraph (version A):
This document provides usage guidance for external Pre-Shared Keys
(PSKs) in TLS.  It lists TLS security properties provided by PSKs
under certain assumptions and demonstrates how violations of these
assumptions lead to attacks.  This document also discusses PSK use
cases, provisioning processes, and TLS stack implementation support
in the context of these assumptions.  It provides advice for
applications in various use cases to help meet these assumptions.
Privacy and security properties not provided by PSKs are also
included.
Paragraph (version A):
There are many resources that provide guidance for password
generation and verification aimed towards improving security.
However, there is no such equivalent for external Pre-Shared Keys
(PSKs) in TLS.  This document aims to reduce that gap.  It lists TLS
security properties provided by PSKs under certain assumptions and
demonstrates how violations of these assumptions lead to attacks.
This document also discusses PSK use cases, provisioning processes,
and TLS stack implementation support in the context of these
assumptions.  It provides advice for applications in various use
cases to help meet these assumptions.
Paragraph (version B):
This document provides usage guidance for external Pre-Shared Keys
(PSKs) in Transport Layer Security (TLS) version 1.3 as defined in
RFC 8446.  It lists TLS security properties provided by PSKs under
certain assumptions and demonstrates how violations of these
assumptions lead to attacks.  It discusses PSK use cases,
provisioning processes, and TLS stack implementation support in the
context of these assumptions.  It provides advice for applications in
various use cases to help meet these assumptions.  It also lists the
privacy and security properties that are not provided by TLS when
external PSKs are used.
Paragraph (version B):
This document provides guidance on the use of external Pre-Shared
Keys (PSKs) in Transport Layer Security (TLS) version 1.3 RFC8446.
This document lists TLS security properties provided by PSKs under
certain assumptions and demonstrates how violations of these
assumptions lead to attacks.  This document discusses PSK use cases,
provisioning processes, and TLS stack implementation support in the
context of these assumptions.  This document also provides advice for
applications in various use cases to help meet these assumptions.
Paragraph (version B):
There are many resources that provide guidance for password
generation and verification aimed towards improving security.
However, there is no such equivalent for external Pre-Shared Keys
(PSKs) in TLS.  This document aims to reduce that gap.
Paragraph (version A):
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 RFC2119 RFC8174 when, and only when, they appear in all capitals,
as shown here.
Paragraph (version B):
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 RFC2119 RFC8174 when, and only when, they appear in all
capitals, as shown here.
Paragraph (version A):
External PSK authentication in TLS allows endpoints to authenticate
connections using previously established keys.  These keys do not
provide protection of endpoint identities (see endpoint-privacy), nor
do they provide non-repudiation (one endpoint in a connection can
deny the conversation).  PSK authentication security implicitly
assumes one fundamental property: each PSK is known to exactly one
client and one server, and that these never switch roles.  If this
assumption is violated, then the security properties of TLS are
severely weakened.
Paragraph (version B):
External PSK authentication in TLS allows endpoints to authenticate
connections using previously established keys.  These keys do not
provide protection of endpoint identities (see endpoint-privacy), nor
do they provide non-repudiation (one endpoint in a connection can
deny the conversation).  Protection of endpoint identities and
protection against an endpoint denying the conversation are possible
when a fresh TLS handshake is performed.
Paragraph (version B):
PSK authentication security implicitly assumes one fundamental
property: each PSK is known to exactly one client and one server, and
that these never switch roles.  If this assumption is violated, then
the security properties of TLS are severely weakened as discussed
below.
Paragraph (version B):
Additionally, a malicious non-member can reroute handshakes between
honest group members to connect them in unintended ways, as described
below.  Note that this class of attack is not possible if each member
uses the SNI extension RFC6066 and terminates the connection on
mismatch.  See Selfie for details.
Paragraph (version A):
Finally, in addition to these weaknesses, sharing a PSK across nodes
may negatively affect deployments.  For example, revocation of
individual group members is not possible without changing the
authentication key for all members.
Paragraph (version B):
Finally, in addition to these weaknesses, sharing a PSK across nodes
may negatively affect deployments.  For example, revocation of
individual group members is not possible without changing
establishing a new PSK for all of the non-revoked members.