Draft: draft-group-tls-external-psk-guidance

Commentary: Sorted the attacks into three classes . 
 do you want to take a stab at this ? 
 Fixed in . 
 ... and describe attacks in all - honest ( general ) model . < img width="616 " alt="Screen       at 3 32 05 PM " src="https://user- " 
 can you take this ? 
 TLS 1.3 tries to maintain 8 security properties in the handshake . A naïve sharing of PSKs , even assuming only honest but curious participants know the key , can violate these properties . Let the group of peers who know the key be A , B , and C. the attacker compromise C. sends a to B. attacker intercepts it , and passes it to C. , under the direction of the attacker , sends a to B , acting as A. responds C thinking he is responding to A. responds to A. completes the handshake ostensibly with B , sending a message . sends a message to B. completes the handshake ostensibly with A. Although neither A nor B has been compromised , both have completed a session , ostensibly with each other , but have established different keys . Let the group of peers who know the key be A , B , and   complete a PSK handshake with B without performing a fresh DHE . , an honest but curious agent , knows the PSK and can derive the session key . Let the group of peers who know the key be A , B , and C. sends a to B. attacker redirects the message to C. responds to A. completes the handshake ostensibly with B , sending a message . attacker redirects the message to C. completes the handshake ostensibly with A. Let the group of peers who know the key be A , B , and C. the attacker compromise C. sends a with no key share to C. attacker repeats the to B. responds to C. attacker repeats the response to A. completes the handshake ostensibly with C , sending a message . attacker repeats the message to B. completes the handshake ostensibly with C. Although neither A nor B has been compromised they have each established a session with the attacker with the same key . Let the group of peers who know the key be A , B , and C. Let A and B support strong and weak cipher suites , but let C support only weaker cipher suites . sends a to B. attacker redirects the message to C. responds to A choosing a weak cipher suite . completes the handshake ostensibly with B , sending a message with a weak cipher suite . attacker redirects the message to C. completes the handshake ostensibly with A. Let the group of peers who know the key be A , B , and C. A establish a PSK session with B , without a fresh DHE . the attacker record the session . the attacker compromise C. The attacker can decrypt the recorded session , even though she compromised C after A and B completed their session . Let the group of peers who know the key be A , B , and C. the attacker compromise A. sends a to B. attacker intercepts the and responds using the PSK learned from A. completes the handshake ostensibly with B , sending a message . Although B was never compromised the attacker is able to impersonate B to A. Although this has not seen any analysis , this appears to be secure , because even honest entities can not distinguish each other . 
 Fixed in . 
 LGTM -- we can clean up nits after !
Paragraph (version A):
The TLS external PSK authentication makes the implicit assumption
that each PSK is known only to one client and one server, which do
not switch roles with the same PSK.
Paragraph (version A):
As discussed in use-cases, there are use cases where multiple clients
or multiple servers share a PSK.  In such cases, TLS only
authenticates the entire group.  Not only can a compromised group
member impersonate another group member, but a malicious non-member
can reroute handshakes between honest group members to connect them
in unintended ways.  This rerouting is a type of identity misbinding
attack Sethi.
Paragraph (version A):
Selfie attack Selfie is a special case of the rerouting attack
against a group member that can act both as TLS server and client.
In the selfie attack, a malicious non-member reroutes a connection
from the client to the server on the same endpoint.
Paragraph (version B):
As discussed in use-cases, there are use cases where multiple clients
or multiple servers share a PSK.  In such cases, TLS only
authenticates the entire group.  Not only can a compromised group
member impersonate another group member, but a malicious non-member
can reroute handshakes between honest group members to connect them
in unintended ways.
Paragraph (version B):
The TLS external PSK authentication mechanism implicitly assumes one
fundamental property: each PSK is known to exactly one client and one
server, and that these never switch roles.  If this assumption is
violated, standard TLS 1.3 security properties are invalidated.
Paragraph (version B):
Endpoint identity protection.
Paragraph (version B):
In the following sub-sections, we list attacks that demonstrate
violations of these properties when the fundamental PSK assumption
does not hold.
Paragraph (version B):
This attack simply requires the adversary to reroute messages without
changing any of their contents.
Paragraph (version B):
Let the group of peers who know the key be "A", "B", and "C".  The
attack proceeds as follows: 1.  "A" sends a "ClientHello" to "B" 2.
The attacker intercepts the message and redirects it to "C" 3.  "C"
responds with to "A" 4.  "A" sends a "Finished" message to "B" "A"
has completed the handshake, ostensibly with "B".  5.  The attacker
redirects the "Finished" message to "C" "C" has completed the
handshake, ostensibly with "A".
Paragraph (version B):
This attack violates the peer authentication property, and if "C"
supports a weaker set of cipher suites than "B", this attack also
violates the downgrade protection property.  This rerouting is a type
of identity misbinding attack Sethi.  Selfie attack Selfie is a
special case of the rerouting attack against a group member that can
act both as TLS server and client.  In the Selfie attack, a malicious
non-member reroutes a connection from the client to the server on the
same endpoint.
Paragraph (version B):
If the client performs a PSK-based handshake without a DHE exchange,
then another trivial attack is possible.
Paragraph (version B):
This attack violates the secrecy of session keys property, because
even an honest but curious "C" can decrypt the session between "A"
and "B".  This attack also violates forward secrecy, because a future
compromise of "C" reveals the contents of the session, however
RFC8446 notes that PSK-based handshakes without a fresh DHE do not
achieve this property.
Paragraph (version B):
If the attacker compromises a client or server then the session is
definitionally insecure, however sharing the key with more than one
client and one server means that compromise of a different actor can
lead to attacks.
Paragraph (version B):
Let the group of peers who know the key be "A", "B", and "C".  The
attack proceeds as follows.  1.  Let the attacker compromise "C" 2.
"A" sends a "ClientHello" to "B" 3.  The attacker intercepts the
message and creates a new "ClientHello" 4.  The attacker sends the
new "ClientHello" to "B" 5.  "B" responds to "A" 6.  The attacker
intercepts the message and creates a new response 7.  The attacker
sends the new response to "A" 8.  "A" sends a "Finished" message to
"B" "A" has completed the handshake, ostensibly with "B".  9.  The
attacker intercepts the "Finished" message and creates a new
"Finished" message 10.  The attacker sends the new "Finished" message
to "B" "B" has completed the handshake, ostensibly with "A".
Paragraph (version B):
This attack, and minor variants of it, violate the remaining
properties outlined above.  The attack violates the same session keys
property, as "A" and "B" have each completed a session, ostensibly
with each other, and yet do not agree on the session key.  If "A"
does not send a key share, then the attacker can have a session with
"A" and a separate session with "B", where both sessions have the
same key.  This violates the uniqueness of session keys property.  In
the case of KCI resistance, where we assume the attacker has
compromised "A", the attacker can successfully impersonate "B" to "A"
using this pattern.