RFC 5489

ECDHE_PSK Cipher Suites for Transport Layer Security (TLS)

📅 published March 2009, from ietf

RFC 5489 ✨ Part 1 of 2 🎀

ECDHE_PSK Cipher Suites for Transport Layer Security (TLS)

okay so this is the title block, the part with the receipts 🧾💅

Network Working Group 🌐
Authors: M. Badra (CNRS/LIMOS Laboratory) and I. Hajjeh (INEOVATION) 👩‍💻
Category: Informational 📚
Date: March 2009 📅
Obsoletes / Updates: the title block doesn't list anything this one obsoletes or updates. It does extend RFC 4279, RFC 4492, and RFC 4785, which you'll see in the Abstract 👀

Status of This Memo

okay so bestie, this memo is just here to inform the Internet community 🦋 It is NOT an Internet standard of any kind, so don't go treating it like one 🙅‍♀️ Distribution is unlimited, so share it with everyone you love 💖

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, as they stand on the day this document was published (http://trustee.ietf.org/license-info). Read those carefully, bestie, because they explain your rights and restrictions for this document 📜🔍

Some of the material in here might come from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people who control the copyright in some of that older material may not have given the IETF Trust permission to allow changes outside the IETF Standards Process 😬 So unless you've got a proper license from those copyright holders, this document may not be modified outside the IETF Standards Process, and you may not make derivative works of it outside that process either. The one exception is formatting it for publication as an RFC, or translating it into languages other than English 🌸

Abstract

okay the vibe here: this document extends RFC 4279, RFC 4492, and RFC 4785 ✨ It defines a bunch of cipher suites that use a pre-shared key (PSK) to authenticate an Elliptic Curve Diffie-Hellman exchange with Ephemeral keys (ECDHE). And the big payoff? These suites give you Perfect Forward Secrecy (PFS) 🔐🔥

   1. Introduction ....................................................2
      1.1. Applicability Statement ....................................3
      1.2. Conventions Used in This Document ..........................3
   2. ECDHE_PSK Key Exchange Algorithm ................................3
   3. ECDHE_PSK-Based Cipher Suites ...................................4
      3.1. ECDHE_PSK Cipher Suites Using the SHA-1 Hash ...............4
      3.2. ECDHE_PSK Cipher Suites Using SHA-2 Hashes .................4
   4. ECDHE_PSK-Based Cipher Suites with NULL Encryption ..............5
      4.1. ECDHE_PSK Cipher Suite Using the SHA-1 Hash with
           NULL Encryption ............................................5
      4.2. ECDHE_PSK Cipher Suites Using SHA-2 Hashes with
           NULL Encryption ............................................5
   5. Security Considerations .........................................5
   6. IANA Considerations .............................................6
   7. Acknowledgments .................................................6
   8. Normative References ............................................6

1. Introduction ✨

okay so RFC 4279 is the one that lays out cipher suites for TLS using pre-shared symmetric keys 🗝️ There are three flavours: (a) ones that only use symmetric key operations for authentication, (b) ones that use a Diffie-Hellman exchange authenticated with a pre-shared key (PSK), and (c) ones that combine public key authentication of the server with pre-shared key authentication of the client 🎀

RFC 4785 is the authentication-only crew 🛡️ No encryption at all. These are super useful when you want authentication and integrity protection but don't need confidentiality, or confidentiality isn't allowed 🙈

RFC 4492 is the ECC (Elliptic Curve Cryptography) one 💎 It defines a set of ECC-based cipher suites for TLS and explains how to use ECC certificates for client authentication. The main moves: it uses Elliptic Curve Diffie-Hellman (ECDH) key agreement in a TLS handshake, and it brings in the Elliptic Curve Digital Signature Algorithm (ECDSA) as a brand new authentication mechanism 🦋

so this document is where it all comes together: a set of cipher suites that use a PSK to authenticate an ECDH exchange 💜 They give you Perfect Forward Secrecy, and some of them are authentication only 🔐

bestie, you're expected to be familiar with RFC 4279, RFC 4492, and RFC 4785 before you dive into this one 📚✨

1.1. Applicability Statement

the cipher suites in this document can be negotiated, whatever TLS version gets negotiated 🌈 And the applicability statement in [RFC4279] applies to this document too, so no skipping it 💅

1.2. Conventions Used in This Document

here's the key words situation 🔑 The words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Those are the rules of the game, so read them as written 🎀

2. ECDHE_PSK Key Exchange Algorithm 🦋

the cipher suites here use the elliptic curve (EC) parameter negotiation mechanism from RFC 4492 🌸 When these cipher suites are in use, the 'ec_diffie_hellman_psk' case inside the ServerKeyExchange and ClientKeyExchange structure MUST be used instead of the 'psk' case from [RFC4279]. In other words, the ServerKeyExchange and ClientKeyExchange messages carry the EC Diffie-Hellman parameters in the form given in Sections 5.4 and 5.7 of [RFC4492] ✨

the PSK identity and identity hint fields mean and encode the same things they do in [RFC4279] 💖 And quick reminder, bestie: the ServerKeyExchange message is always sent, even when no PSK identity hint is given 👀

here's what the messages look like:

   struct {
       select (KeyExchangeAlgorithm) {
           /* other cases for rsa, diffie_hellman, etc. */
           case ec_diffie_hellman_psk:  /* NEW */
               opaque psk_identity_hint<0..2^16-1>;
               ServerECDHParams params;
       };
   } ServerKeyExchange;

   struct {
       select (KeyExchangeAlgorithm) {
           /* other cases for rsa, diffie_hellman, etc. */
           case ec_diffie_hellman_psk:   /* NEW */
               opaque psk_identity<0..2^16-1>;
               ClientECDiffieHellmanPublic public;
           } exchange_keys;
   } ClientKeyExchange;

now the premaster secret, which is giving main character energy 👑 First you do the ECDH computation as described in Section 5.10 of [RFC4492]. Call the octet string that comes out of that computation Z. Then you concatenate four things in order: a uint16 holding the length of Z (in octets), Z itself, a uint16 holding the length of the PSK (in octets), and the PSK itself 🧩

this lines up with the general structure for premaster secrets (see Note 1 in Section 2 of [RFC4279]), where "other_secret" holds Z 🫶

   struct {
       opaque other_secret<0..2^16-1>;
       opaque psk<0..2^16-1>;
   };

3. ECDHE_PSK-Based Cipher Suites 💜

3.1. ECDHE_PSK Cipher Suites Using the SHA-1 Hash

these four cipher suites are the SHA-1 squad 🍓

   CipherSuite TLS_ECDHE_PSK_WITH_RC4_128_SHA          = {0xC0,0x33};
   CipherSuite TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA     = {0xC0,0x34};
   CipherSuite TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA      = {0xC0,0x35};
   CipherSuite TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA      = {0xC0,0x36};

okay so these four match the cipher suites from [RFC4279], with one big glow-up: they use an Elliptic Curve Diffie-Hellman exchange [RFC4492] authenticated with a PSK 🔥 The differences are:

The Message Authentication Code (MAC) is the Hashed Message Authentication Code (HMAC) [RFC2104] with SHA-1 as the hash function 🔒
When it's negotiated in a version of TLS prior to 1.2, the Pseudo-Random Function (PRF) from that version is used. Otherwise, the PRF is the TLS PRF [RFC5246] with SHA-256 as the hash function ✨

3.2. ECDHE_PSK Cipher Suites Using SHA-2 Hashes

these two are the SHA-2 upgrade 🦋

   CipherSuite TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256   = {0xC0,0x37};
   CipherSuite TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384   = {0xC0,0x38};

so these two are the same as the matching Advanced Encryption Standard (AES) cipher suites in Section 3.1 above, except for the hash and PRF algorithms. Those SHALL be as follows 💅

For the cipher suite TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256:
- The MAC is HMAC [RFC2104] with SHA-256 as the hash function.
- When it's negotiated in a version of TLS prior to 1.2, the PRF from that version is used. Otherwise, the PRF is the TLS PRF [RFC5246] with SHA-256 as the hash function.
For the cipher suite TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384:
- The MAC is HMAC [RFC2104] with SHA-384 as the hash function.
- When it's negotiated in a version of TLS prior to 1.2, the PRF from that version is used. Otherwise the PRF is the TLS PRF [RFC5246] with SHA-384 as the hash function.

⚠️ bestie, Section 4 is where the NULL encryption suites show up, and that's coming in part 2 👀

8. Normative References ✨

okay bestie, this is the reading list the spec says you need before you can make sense of it 📚 here's the whole squad, every single one:

[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997. 🔐
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 💅 this is the one that defines all those capitalised key words we've been yelling about 📣
[RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)", RFC 4279, December 2005. 🎀
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)", RFC 4492, May 2006. 🦋
[RFC4785] Blumenthal, U. and P. Goel, "Pre-Shared Key (PSK) Ciphersuites with NULL Encryption for Transport Layer Security (TLS)", RFC 4785, January 2007. 🌸
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008. 👑 this is the big TLS 1.2 spec that the whole ECDHE_PSK thing sits on top of 🧚

Authors' Addresses 💌

Mohamad Badra
CNRS/LIMOS Laboratory
Campus de cezeaux, Bat. ISIMA
Aubiere  63170
France

EMail: badra@isima.fr


Ibrahim Hajjeh
INEOVATION
France

EMail: ibrahim.hajjeh@ineovation.fr

and that's the whole spec, bestie!! 🎉💖 ✨ 🫶

📦 where this page comes from

ietf: rfc5489 2009-03
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms