RFC 5487

Pre-Shared Key Cipher Suites for TLS with SHA-256/384 and AES Galois Counter Mode

📅 published March 2009, from ietf

RFC 5487: Pre-Shared Key Cipher Suites for TLS with SHA-256/384 and AES Galois Counter Mode 🎀

okay bestie, this one is by M. Badra from the CNRS/LIMOS Laboratory 🧚. It's a Standards Track doc from March 2009, so it's an actual Internet standard, not just an idea floating around 💅. It doesn't obsolete anything or update anything, at least not according to its title block. It's a brand new add-on to TLS's pre-shared key (PSK) cipher suites, the ones from [RFC4279] and [RFC4785]. Those older ones all use SHA-1, which is kinda cringe now, so this doc brings in SHA-256/384 and AES-GCM 💜.

Status of This Memo

okay so this part is the official "what kind of doc is this" stuff 📜. It's an Internet standards track protocol for the whole Internet community, and it's asking for discussion and suggestions for improvements 🫶. If you want to know where this protocol stands in standardization, check the current edition of "Internet Official Protocol Standards" (STD 1), which is the source of truth for that 🔥. The distribution of this memo is unlimited, so share it with everyone you know 🌸.

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, as they were on the date it was published. It's at http://trustee.ietf.org/license-info, so read those carefully because they explain what you're allowed to do with it and what you aren't 📖.

Heads up for the boring-but-important part: this document might have material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people who control the copyright on some of that stuff might not have given the IETF Trust permission to let it be modified outside the IETF Standards Process. So unless you get a proper license from those copyright holders, you can't modify this document outside the IETF Standards Process, and you can't make derivative works of it outside that process either. The only exceptions are formatting it for publication as an RFC, or translating it into languages other than English 🌈. (Yes, I'm literally doing a translation of sorts right now, but it's for fun, not publication 😭.)

Abstract

so the big picture is this 👑. [RFC4279] and [RFC4785] describe pre-shared key cipher suites for Transport Layer Security (TLS). But every single one of those suites uses SHA-1 in its Message Authentication Code (MAC) algorithm 💀. This doc adds two new sets of PSK cipher suites for TLS 🦋:

One set uses stronger digest algorithms, meaning SHA-256 or SHA-384 🔥.
The other set uses the Advanced Encryption Standard (AES) in Galois Counter Mode (GCM) ✨.

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
  1.1.  Applicability Statement . . . . . . . . . . . . . . . . . . 3
  1.2.  Conventions Used in This Document . . . . . . . . . . . . . 3
2.  PSK, DHE_PSK, and RSA_PSK Key Exchange Algorithms with
    AES-GCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3.  PSK, DHE_PSK, and RSA_PSK Key Exchange with SHA-256/384 . . . . 4
  3.1.  PSK Key Exchange Algorithm with SHA-256/384 . . . . . . . . 4
  3.2.  DHE_PSK Key Exchange Algorithm with SHA-256/384 . . . . . . 5
  3.3.  RSA_PSK Key Exchange Algorithm with SHA-256/384 . . . . . . 5
4.  Security Considerations . . . . . . . . . . . . . . . . . . . . 5
5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 5
6.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 6
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 6
  7.1.  Normative References  . . . . . . . . . . . . . . . . . . . 6
  7.2.  Informative References  . . . . . . . . . . . . . . . . . . 7

1. Introduction ✨

okay so PSK authentication is the main character here 🧚. The benefits of using a pre-shared symmetric key instead of a public/private key pair for key exchange in TLS were already explained in the Introduction of [RFC4279]. So go read that first. This doc basically takes the algorithms that already exist and plugs in newer, generally considered stronger, cryptographic primitives and building blocks 💅.

Here's the glow-up part 💖. TLS 1.2 [RFC5246] added support for authenticated encryption with additional data (AEAD) cipher modes [RFC5116]. This doc uses AES in Galois Counter Mode [GCM] (AES-GCM) with the various PSK authenticated key exchange mechanisms from [RFC4279] and [RFC4785], inside cipher suites for TLS 🌸.

The doc also adds PSK cipher suites for TLS that swap out SHA-1 for SHA-256 or SHA-384 [SHS]. Like I said, [RFC4279] and [RFC4785] already have PSK cipher suites, but all of the suites in both of those use HMAC-SHA1 as their MAC algorithm 😭. And because of recent analytic work on SHA-1 [Wang05], the IETF is gradually moving away from SHA-1 and toward stronger hash algorithms. That's the whole reason this exists 🔥.

Related TLS cipher suites are also new. The key exchange algorithms in these are authenticated using public/private key pairs, and they were specified recently:

RSA-, DSS-, and Diffie-Hellman-based cipher suites in [RFC5288], and
ECC-based cipher suites with SHA-256/384 and AES-GCM in [RFC5289].

Before you dive into this doc, you're expected to get familiar with those two memos first 📖. Trust me, it makes everything else click 🦋.

1.1. Applicability Statement

here's when things can be negotiated 🎀. The cipher suites defined in Section 3 can be negotiated whatever the negotiated TLS version is 💜.

The cipher suites defined in Section 2 can be negotiated in TLS version 1.2 or higher 👑. So if you're stuck on an older version, Section 2 isn't for you, sorry bestie 💀.

The applicability statement in [RFC4279] applies to this document as well 🫶.

1.2. Conventions Used in This Document

this is the part where the capital letters matter 🙈. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📜. Those are the official requirement words, so when you see them, they're not just vibes, they're rules ✨.

2. PSK, DHE_PSK, and RSA_PSK Key Exchange Algorithms with AES-GCM 🦋

the first big batch is the AES-GCM group, and it's six cipher suites total 💅. These use the new authenticated encryption modes that TLS 1.2 added, which means AES in Galois Counter Mode [GCM] 🔥. The two suites with the DHE_PSK key exchange algorithm, TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 and TLS_DHE_PSK_WITH_AES_256_GCM_SHA348, provide Perfect Forward Secrecy (PFS) 🌈.

heads up bestie 🙈: the original spells the second one as SHA348 right here. I've kept it exactly as written because the name has to match. The IANA section later on lists the same suite with SHA384, so don't mix them up when you're implementing.

Here are the six suites, copied exactly as written 🎀:

CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA256        = {0x00,0xA8};
CipherSuite TLS_PSK_WITH_AES_256_GCM_SHA384        = {0x00,0xA9};
CipherSuite TLS_DHE_PSK_WITH_AES_128_GCM_SHA256    = {0x00,0xAA};
CipherSuite TLS_DHE_PSK_WITH_AES_256_GCM_SHA348    = {0x00,0xAB};
CipherSuite TLS_RSA_PSK_WITH_AES_128_GCM_SHA256    = {0x00,0xAC};
CipherSuite TLS_RSA_PSK_WITH_AES_256_GCM_SHA384    = {0x00,0xAD};

These cipher suites use authenticated encryption with additional data (AEAD) algorithms, AEAD_AES_128_GCM and AEAD_AES_256_GCM, as described in [RFC5116] ✨. GCM gets used the way [RFC5288] describes 💖.

The PSK, DHE_PSK, and RSA_PSK key exchanges are done exactly as [RFC4279] defines them 🫶.

The Pseudo-Random Function (PRF) algorithms SHALL be as follows 👑:

For cipher suites ending with _SHA256, the PRF is the TLS PRF [RFC5246] with SHA-256 as the hash function.
For cipher suites ending with _SHA384, the PRF is the TLS PRF [RFC5246] with SHA-384 as the hash function.

And here's a strict one 🚨. Implementations MUST send a TLS Alert 'bad_record_mac' for all types of failures they run into while processing the AES-GCM algorithm. No exceptions, no "it's fine" energy, MUST means MUST 💀.

(Part 1 of 2. Part 2 picks up with Section 3, the CBC and NULL suites, plus Security Considerations, IANA Considerations, and the References.)

6. Acknowledgments 🫶

Okay bestie, this is the thank-you speech 🥹 This document borrows from [RFC5289], so big shoutout to that one 💖. The author gives a huge thank you to Alfred Hoenes for his detailed review and for working through issues during the discussion. He's literally the MVP ✨. The author also wants to acknowledge Ibrahim Hajjeh, Simon Josefsson, Hassnaa Moustafa, Joseph Salowey, and Pascal Urien for reviewing the content of the document 🌸 ily all 🎀

7. References 📚

7.1. Normative References

[AES] National Institute of Standards and Technology, "Specification for the Advanced Encryption Standard (AES)", FIPS 197, November 2001. 🔐
[GCM] National Institute of Standards and Technology, "Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authentication", SP 800-38D, November 2007. 💜
[MODES] National Institute of Standards and Technology, "Recommendation for Block Cipher Modes of Operation - Methods and Techniques", SP 800-38A, December 2001.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997. 🎀
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 👑
[RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)", RFC 4279, December 2005. 🦋
[RFC4785] Blumenthal, U. and P. Goel, "Pre-Shared Key (PSK) Ciphersuites with NULL Encryption for Transport Layer Security (TLS)", RFC 4785, January 2007.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated Encryption", RFC 5116, January 2008. 🌈
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008. ⭐
[RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, August 2008. 🍓
[SHS] National Institute of Standards and Technology, "Secure Hash Standard", FIPS 180-2, August 2002. 🧚

7.2. Informative References

[RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, August 2008. 💅
[Wang05] Wang, X., Yin, Y., and H. Yu, "Finding Collisions in the Full SHA-1", CRYPTO 2005, August 2005. 🙈

Author's Address ✨

   Mohamad Badra
   CNRS/LIMOS Laboratory
   Campus de cezeaux, Bat. ISIMA
   Aubiere  63170
   France

   EMail: badra@isima.fr

That's the whole doc, bestie 🌸 you made it through the entire thing 👑

📦 where this page comes from

ietf: rfc5487 2009-03
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms