TLS PSK #3553

Activity

1. mscdex

   added

   questionIssues asking questions about Node.js.Issues asking questions about Node.js.

   tlsIssues and PRs related to the tls subsystem.Issues and PRs related to the tls subsystem.

   on Oct 27, 2015
2. mscdex commented on Oct 27, 2015

   

   mscdex

   on Oct 27, 2015

   Contributor

   More actions

   /cc @nodejs/crypto
3. bnoordhuis commented on Oct 27, 2015

   

   bnoordhuis

   on Oct 27, 2015

   Member

   More actions

   There's no PSK support at this time. I'm not aware of any workarounds except maybe putting a TLS terminator in front of node. What's your use case?
4. reesew commented on Oct 27, 2015

   

   reesew

   on Oct 27, 2015

   Author

   More actions

   Main/priority use case is a device that connects to servers using PSK, I think because it is less computationally/battery intensive. That is its only TLS method (ECDHE PSK). Second use case I'm just exploring, using PSK for communication between distributed microservices, rather than setting up a CA or something. I'm not really sure of the best way to ensure encrypted communication between services at this point. TLS terminator may work for the first use case, if I can figure out a good alternative solution for the second, but I'm a little outside my area of expertise
5. bnoordhuis commented on Oct 27, 2015

   

   bnoordhuis

   on Oct 27, 2015

   Member

   More actions

   Speaking from prior experience, PSK is a bit of a hassle unless all peers are configured exactly the same. If your network is heterogeneous, brace yourself for late-night debugging sessions. The custom CA approach, optionally with client certificates, is much easier.
6. reesew commented on Oct 27, 2015

   

   reesew

   on Oct 27, 2015

   Author

   More actions

   Unfortunate...
   Any suggestions on a tls terminator solution? I haven't been able to find anything yet, and it sounds like that might be my only alternative
7. bnoordhuis commented on Oct 27, 2015

   

   bnoordhuis

   on Oct 27, 2015

   Member

   More actions

   I thought Apache's mod_ssl did but seems I was mistaken. Some quick googling suggests there isn't much that supports PSK at the moment.

   PSK is not that hard to implement so it might be worth doing in node.js. On the other hand, it's kind of obscure and the tls module is already pretty bulky so I'm a little torn here.
8. reesew commented on Oct 27, 2015

   

   reesew

   on Oct 27, 2015

   Author

   More actions

   well... there is a TODO comment about it. just saying... (=
9. shigeki commented on Oct 28, 2015

   

   shigeki

   on Oct 28, 2015

   Contributor

   More actions

   PSK use cases of 3GPP and IoT are described in https://www.ietf.org/proceedings/93/slides/slides-93-tls-6.pdf .

   But the current openssl-1.0.2 does not support PSF in PSK(DHE-PSK/ECDHE-PSK) so that it cannot protect encrypted data in the past if pre-shared key is compromised.

    ./openssl ciphers -v |grep PSK
   PSK-AES256-CBC-SHA      SSLv3 Kx=PSK      Au=PSK  Enc=AES(256)  Mac=SHA1
   PSK-AES128-CBC-SHA      SSLv3 Kx=PSK      Au=PSK  Enc=AES(128)  Mac=SHA1
   PSK-RC4-SHA             SSLv3 Kx=PSK      Au=PSK  Enc=RC4(128)  Mac=SHA1
   PSK-3DES-EDE-CBC-SHA    SSLv3 Kx=PSK      Au=PSK  Enc=3DES(168) Mac=SHA1
   

   Unless we have clear requirements to use PSK, I'd like to wait for DHE-PSK/ECDHE-PSK to be supported.
10. evanlucas commented on Feb 2, 2016

    

    evanlucas

    on Feb 2, 2016

    Contributor

    More actions

    Going ahead and closing due to inactivity. Feel free to reopen if necessary. Thanks!
11. evanlucas

    closed this as completedon Feb 2, 2016