RFC 9257

Guidance for External Pre-Shared Key (PSK) Usage in TLS

📅 published July 2022, from ietf

🎀 RFC 9257: Guidance for External Pre-Shared Key (PSK) Usage in TLS 🦋

okay bestie, this is the doc that tells us how to use external PSKs in TLS without messing it up 💅 it's Informational, not a Standards Track thing, and it came out July 2022 ✨ the main authors are R. Housley (Vigil Security), J. Hoyland (Cloudflare Ltd.), M. Sethi (Aalto University), and C. A. Wood (Cloudflare) 🫶 it's ISSN 2070-1721 and it doesn't obsolete or update anything, so it's its own little main character 👑

Now let's get into it 🌸

Abstract

so this doc gives usage guidance for external PSKs in TLS 1.3 (the one from [RFC8446]) 💖 it lists the security properties PSKs give you under certain assumptions, then shows how breaking those assumptions leads to attacks 😭 it also has advice for apps to help them meet the assumptions, talks about PSK use cases and how they get provisioned, and finally lists the privacy and security stuff TLS 1.3 doesn't give you when external PSKs are in play 🙈

Status of This Memo

this one's not an Internet Standards Track spec, it's just published for info 🧚 it still went through the IETF process: it's consensus from the IETF community, got public review, and was approved by the IESG 🔥 not every IESG-approved doc is a candidate for a Standard though, see Section 2 of RFC 7841 for that 💅

if you want the current status, errata, or to send feedback, go to https://www.rfc-editor.org/info/rfc9257 🌈

Copyright Notice

Copyright (c) 2022 IETF Trust and the authors, all rights reserved 🎀 this doc is under BCP 78 and the IETF Trust's Legal Provisions (https://trustee.ietf.org/license-info) as of publication, so read those if you care about your rights 🫶 if you pull code components out of this doc, they have to include Revised BSD License text (Section 4.e of the Trust Legal Provisions) and come without warranty, as the Revised BSD License says 💜

1.  Introduction
2.  Conventions and Definitions
3.  Notation
4.  PSK Security Properties
  4.1.  Shared PSKs
  4.2.  PSK Entropy
5.  External PSKs in Practice
  5.1.  Use Cases
  5.2.  Provisioning Examples
  5.3.  Provisioning Constraints
6.  Recommendations for External PSK Usage
  6.1.  Stack Interfaces
    6.1.1.  PSK Identity Encoding and Comparison
    6.1.2.  PSK Identity Collisions
7.  Privacy Considerations
8.  Security Considerations
9.  IANA Considerations
10. References
  10.1.  Normative References
  10.2.  Informative References
Acknowledgements
Authors' Addresses

1. Introduction ✨

okay so this doc is all about external PSKs in TLS 1.3 [RFC8446] 💖 the guidance also applies to DTLS 1.3 [RFC9147] and Compact TLS 1.3 [CTLS], and for readability we just say "TLS" to mean all of those 🦋

external PSKs are symmetric secret keys given to the TLS implementation as external inputs 🔑 they get provisioned out of band, meaning not through TLS itself 🧚

this doc lists the TLS security properties PSKs give you under certain assumptions, and shows how breaking those assumptions leads to attacks 😭 it talks about use cases, provisioning, and TLS stack support in light of those assumptions, and it gives apps advice for various use cases so they can meet the assumptions 💅

ngl there are tons of resources on password generation and verification to make things more secure 🙈 but for external PSKs in TLS? nothing like that exists yet 💀 this doc is here to close that gap 🫶

2. Conventions and Definitions 🎀

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this doc are interpreted as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals like that 💜 lowercase versions are just regular words, bestie 🌸

3. Notation 🦋

for this doc, a "logical node" is a computing presence that other parties can talk to over TLS 🧚 a logical node could be made of multiple physical instances under common admin control, like a server farm 🍓 an "endpoint" is a client or server taking part in a connection 💖

4. PSK Security Properties 💅

using a PSK you've already set up lets TLS nodes authenticate the endpoint identities 🔐 it also has other perks, including resistance to attacks from quantum computers (more in Section 4.2) 🌈 BUT these keys don't give you privacy protection for endpoint identities, and they don't give you non-repudiation either, which means one endpoint in a connection can deny the conversation happened 😭 see Section 7 for more on that 🙈

PSK authentication security quietly assumes one big thing: each PSK is known to exactly one client and one server, and they never switch roles 🫶 if that assumption gets violated, TLS's security gets seriously weakened, as we'll see below 💀

4.1. Shared PSKs ⭐

as Section 5.1 talks about, [AASS19] shows attack scenarios where multiple clients or multiple servers share a PSK 👀 if you do this naively and everyone shares one common key, then TLS only authenticates group membership, and the whole system is honestly pretty brittle 😬 there are a few obvious weaknesses:

any group member can impersonate any other group member 💀
if a PSK gets combined with the result of a fresh ephemeral key exchange, then compromising a group member who knows the resulting shared secret lets an attacker passively read traffic (and actively modify it) 😭
if a PSK does not get combined with a fresh ephemeral key exchange, then compromising any group member lets the attacker passively read all traffic (and actively modify it), including past traffic 🫠

also, a malicious non-member can reroute handshakes between honest group members so they connect in unintended ways, as described below 🙈 there's a partial mitigation for this class of attack: each group member includes the Server Name Indication (SNI) extension [RFC6066] and ends the connection if the presented SNI doesn't match the receiving member's known identity 🛡️ see [Selfie] for details 🎀

so let's walk through the rerouting attack with three peers, A, B, and C, who all know the PSK 🧚 here's how it goes:

A sends a ClientHello to B. 💌
the attacker intercepts the message and redirects it to C. 😈
C responds with a second flight (ServerHello, ...) to A. 📨
A sends a Finished message to B. A thinks it finished the handshake, ostensibly with B 🥺
the attacker redirects the Finished message to C. and now C has completed the handshake with A 💀

in this attack, peer authentication isn't provided 😭 also, if C supports a weaker set of ciphersuites than B, cryptographic algorithm downgrade attacks might be possible 👀 this rerouting is a type of identity misbinding attack [Krawczyk] [Sethi] 🦋 the Selfie attack [Selfie] is a special case of rerouting against a group member that can act as both a TLS server and a client 🪞 in the Selfie attack, a malicious non-member reroutes a connection from the client to the server on the same endpoint 🙈

finally, on top of all this, sharing a PSK across nodes can mess up deployments too 😩 for example, you can't revoke individual group members without setting up a brand new PSK for all the members who haven't been revoked 🥲

4.2. PSK Entropy 🌈

the entropy of external PSKs can also affect TLS security properties 🧠 for example, if a high-entropy PSK is used, then PSK-only key establishment modes give you the expected security properties for TLS: same session keys between peers, secrecy of session keys, peer authentication, and downgrade protection 💖 see Appendix E.1 of [RFC8446] for an explanation of those 📖 BUT these modes lack forward security 😬 you can get forward security by using a PSK-DH mode or by using PSKs with short lifetimes ⏳

now if a low-entropy PSK is used, things get spicy 🌶️ PSK-only key establishment modes are open to passive exhaustive search attacks, which will reveal the traffic keys 💀 PSK-DH modes are open to active attacks where the attacker impersonates one side 😱 the exhaustive search phase of these attacks can be run offline if the attacker captures a single handshake using the PSK 🕵️ but those attacks won't compromise the traffic keys for that connection, because those also depend on the Diffie-Hellman (DH) exchange 🙌 low-entropy keys are only secure against active attack if a Password-Authenticated Key Exchange (PAKE) is used with TLS 🔐 at the time of writing, the Crypto Forum Research Group (CFRG) is working on recommended PAKEs (see [CPACE] and [OPAQUE] for the symmetric and asymmetric cases, respectively) 🧚

5. External PSKs in Practice 🍓

PSK ciphersuites were first specified for TLS back in 2005 🕰️ PSKs are now an integral part of the TLS 1.3 spec [RFC8446] 💜 TLS 1.3 also uses PSKs for session resumption, and it tells these resumption PSKs apart from external PSKs that were provisioned out of band 🫶 this section covers known use cases and provisioning processes for external PSKs with TLS 🎀

more to come in part 2 bestie, don't go anywhere 🧚💖

5.1. Use Cases ✨

okay bestie, this is the good part 🦋 Here's a list of example use cases where pairwise external PSKs (i.e., external PSKs that are shared between only one server and one client) have been used for authentication in TLS. There was zero attempt to rank them, so no drama about which one is #1 💅

Device-to-device communication with out-of-band synchronized keys. PSKs get provisioned out of band for talking to known identities 🔐, and the identity to use is discovered through a different online protocol. so cute 🧚
Intra-data-center communication. Machine-to-machine communication inside a single data center or Point of Presence (PoP) may use externally provisioned PSKs 🖥️. This is mainly so TLS connections can carry early data ⚡. See Section 8 for considerations when using early data with external PSKs.
Certificateless server-to-server communication. Machine-to-machine communication may use externally provisioned PSKs 🤖. This is mainly for setting up TLS connections without the overhead of provisioning and managing PKI certificates. no certs, no problem 🙌
Internet of Things (IoT) and devices with limited computational capabilities. [RFC7925] defines TLS and DTLS profiles for resource-constrained devices 🌸 and suggests the use of PSK ciphersuites for compliant devices. The Open Mobile Alliance Lightweight Machine-to-Machine (LwM2M) Technical Specification [LwM2M] says that LwM2M servers MUST support the PSK mode of DTLS 💜.
Securing RADIUS [RFC2865] with TLS. PSK ciphersuites are optional for this use case, as specified in [RFC6614] 🎀.
3GPP server-to-user equipment authentication. The Generic Authentication Architecture (GAA) defined by 3GPP mentions that TLS PSK ciphersuites can be used between server and user equipment for authentication [GAA] 📱.
Smart Cards. The German electronic Identity (eID) card supports authentication of a card holder to online services with TLS PSK [SmartCard] 🇩🇪💳.
Quantum resistance. Some deployments may use PSKs (or combine them with certificate-based authentication as described in [RFC8773]) because of the protection they provide against quantum computers ⚛️🛡️. protect the future era, periodt 🔥

There are also use cases where PSKs are shared between more than two entities 👯. Some examples are below (as noted by Akhmetzyanova, et al. [AASS19]):

Group chats. In this use case, group participants may be provisioned an external PSK out of band for setting up authenticated connections with other members of the group 💬✨. bestie group chat energy, literally.
IoT and devices with limited computational capabilities. Many PSK provisioning examples are possible here 🤯. For example, IoT devices may all share the same PSK and use it to talk to a central server (one key for n devices) 🔑, have their own key for talking to a central server (n keys for n devices) 🗝️, or have pairwise keys for talking to each other (n^2 keys for n devices) 😵‍💫.

5.2. Provisioning Examples 🧁

The exact provisioning process depends on the system requirements and threat model 🕵️‍♀️. Whenever possible, avoid sharing a PSK between nodes. Sometimes sharing a PSK among several nodes is unavoidable, though 😩. When PSK sharing happens, other accommodations SHOULD be used as discussed in Section 6.

Here are some examples of PSK provisioning processes:

Many industrial protocols assume that PSKs are distributed and assigned manually via one of these approaches: (1) typing the PSK into the devices or (2) using a trust-on-first-use (TOFU) approach, with a device completely unprotected before the first login took place 🏭. Lots of devices have a very limited UI. For example, they may only have a numeric keypad or even fewer buttons 🔢. When the TOFU approach isn't suitable, entering the key would mean typing it on a constrained UI, and ngl that's painful 😭.
Some devices provision PSKs via an out-of-band, cloud-based syncing protocol ☁️🔄.
Some secrets may be baked into hardware or software device components 🔩. Moreover, when this is done at manufacturing time, secrets may be printed on labels or included in a Bill of Materials for ease of scanning or import 🏷️📦.

5.3. Provisioning Constraints 🚧

PSK provisioning systems are often constrained in application-specific ways 💅. For example, although one goal of provisioning is to ensure that each pair of nodes has a unique key pair, some systems don't want to distribute pairwise shared keys to get there 🙅‍♀️. As another example, some systems require the provisioning process to embed application-specific information in either PSKs or their identities. Identities may sometimes need to be routable, as is currently under discussion for [EAP-TLS-PSK] 🛣️.

6. Recommendations for External PSK Usage 📝👑

Recommended requirements for applications using external PSKs are as follows 🫶:

Each PSK SHOULD be derived from at least 128 bits of entropy, MUST be at least 128 bits long, and SHOULD be combined with an ephemeral key exchange, e.g., by using the "psk_dhe_ke" Pre-Shared Key Exchange Mode in TLS 1.3 for forward secrecy 🔒✨. As discussed in Section 4, low-entropy PSKs (i.e., those derived from less than 128 bits of entropy) are subject to attack and SHOULD be avoided 🚫. If only low-entropy keys are available, then key establishment mechanisms such as PAKE that mitigate the risk of offline dictionary attacks SHOULD be employed 🧠. Note that no such mechanisms have been standardized yet, and further, these mechanisms won't necessarily follow the same architecture as the process for incorporating external PSKs described in [RFC9258] 🤷‍♀️.
Unless other accommodations are made to mitigate the risks of PSKs known to a group, each PSK MUST be restricted in its use to at most two logical nodes: one logical node in a TLS client role and one logical node in a TLS server role. (The two logical nodes MAY be the same, in different roles.) Two acceptable accommodations are described in [RFC9258]: (1) exchanging client and server identifiers over the TLS connection after the handshake and (2) incorporating identifiers for both the client and the server into the context string for an external PSK importer 🎀.
Nodes SHOULD use external PSK importers [RFC9258] when configuring PSKs for a client-server pair, when applicable 🔑. Importers make provisioning external PSKs easier and less error-prone by deriving a unique, imported PSK from the external PSK for each key derivation function a node supports 🪄. See the Security Considerations of [RFC9258] for more information 📖.
Where possible, the main PSK (that which is fed into the importer) SHOULD be deleted after the imported keys have been generated 🗑️. This prevents an attacker from bootstrapping a compromise of one node into the ability to attack connections between any node. Otherwise, the attacker can recover the main key and then re-run the importer itself 😱.

⚠️ bestie, this part is serious: if the main PSK sticks around after the imported keys exist, one compromised node can become a compromise of the whole group. delete it when you can 💀

6.1. Stack Interfaces 🧩

Most major TLS implementations support external PSKs 🎉. Stacks that support external PSKs provide interfaces that applications may use when configuring PSKs for individual connections. Here are some of the existing stacks at the time of writing:

OpenSSL and BoringSSL: Applications can specify support for external PSKs via distinct ciphersuites in TLS 1.2 and below 🧶. They can also configure callbacks that are invoked for PSK selection during the handshake. These callbacks must provide a PSK identity and key. The exact format of the callback depends on the negotiated TLS protocol version, with new callback functions added specifically to OpenSSL for TLS 1.3 [RFC8446] PSK support 🆕. The PSK length is validated to be between 1-256 bytes (inclusive), and the PSK identity may be up to 128 bytes long 📏.
mbedTLS: Client applications configure PSKs before creating a connection by providing the PSK identity and value inline 📝. Servers must implement callbacks similar to those in OpenSSL. Both PSK identity and key lengths may be between 1-16 bytes long (inclusive) 🦋.
gnuTLS: Applications configure PSK values as either raw byte strings or hexadecimal strings 🔢. The PSK identity and key size are not validated 🙈.
wolfSSL: Applications configure PSKs with callbacks similar to OpenSSL 🐺.

6.1.1. PSK Identity Encoding and Comparison 🔤

Section 5.1 of [RFC4279] mandates that the PSK identity should first be converted to a character string and then encoded to octets using UTF-8. This was done to avoid interoperability problems, especially when the identity is configured by human users 🧑‍💻. On the other hand, [RFC7925] advises implementations against assuming any structured format for PSK identities, and it recommends byte-by-byte comparison for any operation 🔍. When PSK identities are configured manually, it's important to remember that visually identical strings may, in fact, differ due to encoding issues 👀.

TLS 1.3 [RFC8446] follows the same practice of specifying the PSK identity as a sequence of opaque bytes (shown as opaque identity<1..2^16-1> in the specification), so it gets compared on a byte-by-byte basis 🧮. [RFC8446] also requires that PSK identities are at least 1 byte and at most 65535 bytes in length 📐. Although [RFC8446] doesn't place strict requirements on the format of PSK identities, the format can vary depending on the deployment 🌈:

The PSK identity MAY be a user-configured string when used in protocols like Extensible Authentication Protocol (EAP) [RFC3748]. For example, gnuTLS treats PSK identities as usernames 👤.
PSK identities MAY have a domain name suffix for roaming and federation. In applications and settings where the domain name suffix is privacy sensitive, this practice is NOT RECOMMENDED 🙅‍♀️.
Deployments should take care that the length of the PSK identity is sufficient to avoid collisions 🧐.

6.1.2. PSK Identity Collisions 💥

It's possible, though unlikely, that an external PSK identity may clash with a resumption PSK identity 🎲. The TLS stack implementation and the sequencing of PSK callbacks influence how the application behaves when identity collisions happen 🌀. When a server receives a PSK identity in a TLS 1.3 ClientHello, some TLS stacks execute the application's registered callback function before checking the stack's internal session resumption cache. This means that if a PSK identity collision occurs, the application's external PSK usage will typically take precedence over the internal session resumption path 🏃‍♀️.

Because resumption PSK identities are assigned by the TLS stack implementation, it is RECOMMENDED that these identifiers be assigned in a manner that lets resumption PSKs be distinguished from external PSKs, so collision concerns go away altogether ✨🦋

7. Privacy Considerations 🔒✨

Okay bestie, privacy is its own whole thing 🦋 PSK privacy properties are orthogonal to the security properties we covered in Section 4, so being secure and being private are two different vibes 💅 TLS honestly does very little to keep PSK identity info private 🙈 The identifier shows up in cleartext inside a ClientHello, so anyone watching learns something about the external PSK or its identifier 👀 That means a passive adversary can link two or more connections that use the same external PSK on the wire. Depending on the PSK identity, a passive attacker might even figure out which device, person, or enterprise is running the TLS client or TLS server 😭 And an active attacker can use the PSK identity to suppress handshakes or application data from one specific device by blocking, delaying, or rate-limiting traffic 💀 Techniques for mitigating these risks need further analysis, so they're out of scope for this document 🫶

Also, external PSKs are intrinsically linkable by PSK receivers 🧚 Servers can link successive connections that use the same external PSK together. Preventing this type of linkability is out of scope, bestie.

8. Security Considerations 🛡️

Security considerations are sprinkled throughout this document, but it bears repeating (dramatic, I know 💅). There are concerns with external PSKs about proper identification of TLS 1.3 endpoints, plus extra risks when external PSKs are known to a group 🚨

It is NOT RECOMMENDED to share the same PSK between more than one client and server. 🙅‍♀️ However, as discussed in Section 5.1, there are application scenarios that may rely on sharing the same PSK among multiple nodes. [RFC9258] helps in mitigating rerouting and Selfie-style reflection attacks when the PSK is shared among multiple nodes ✨ This is achieved by correctly using the node identifiers in the ImportedIdentity.context construct specified in [RFC9258]. One solution would be for each endpoint to pick one globally unique identifier to use in all PSK handshakes. That identifier could be, for example, one of its Media Access Control (MAC) addresses, a 32-byte random number, or its Universally Unique IDentifier (UUID) [RFC4122]. Note that such persistent, global identifiers have privacy implications, so check out Section 7 🦋

Each endpoint SHOULD know the identifier of the other endpoint it wants to connect with, and SHOULD compare it with the other endpoint's identifier used in ImportedIdentity.context. 🔍 However, it is important to remember that endpoints sharing the same group PSK can always impersonate each other. Not ideal, bestie 😭

Considerations for external PSK usage go beyond proper identification 💖 When early data is used with an external PSK, the random value in the ClientHello is the only source of entropy that contributes to key diversity between sessions. So when an external PSK is used more than one time, the random number source on the client has a significant role in protecting the early data 🎀

9. IANA Considerations 🌸

This document has no IANA actions. Nothing to register here, periodt 💅

10. References 📚

10.1. Normative References

These are the must-read sources 🤓

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
              Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
              <https://www.rfc-editor.org/info/rfc8446>.

   [RFC9258]  Benjamin, D. and C. A. Wood, "Importing External Pre-
              Shared Keys (PSKs) for TLS 1.3", RFC 9258,
              DOI 10.17487/RFC9258, July 2022,
              <https://www.rfc-editor.org/info/rfc9258>.

10.2. Informative References

These are the deep-dive reads for when you're obsessed 🧐💜

   [AASS19]   Akhmetzyanova, L., Alekseev, E., Smyshlyaeva, E., and A.
              Sokolov, "Continuing to reflect on TLS 1.3 with external
              PSK", April 2019, <https://eprint.iacr.org/2019/421.pdf>.

   [CPACE]    Abdalla, M., Haase, B., and J. Hesse, "CPace, a balanced
              composable PAKE", Work in Progress, Internet-Draft, draft-
              irtf-cfrg-cpace-06, 24 July 2022,
              <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-
              cpace-06>.

   [CTLS]     Rescorla, E., Barnes, R., Tschofenig, H., and B. M.
              Schwartz, "Compact TLS 1.3", Work in Progress, Internet-
              Draft, draft-ietf-tls-ctls-06, 9 July 2022,
              <https://datatracker.ietf.org/doc/html/draft-ietf-tls-
              ctls-06>.

   [EAP-TLS-PSK]
              Mattsson, J. P., Sethi, M., Aura, T., and O. Friel, "EAP-
              TLS with PSK Authentication (EAP-TLS-PSK)", Work in
              Progress, Internet-Draft, draft-mattsson-emu-eap-tls-psk-
              00, 9 March 2020, <https://datatracker.ietf.org/doc/html/
              draft-mattsson-emu-eap-tls-psk-00>.

   [GAA]      ETSI, "Digital cellular telecommunications system (Phase
              2+); Universal Mobile Telecommunications System (UMTS);
              LTE; 3G Security; Generic Authentication Architecture
              (GAA); System description", version 12.0.0, ETSI TR 133
              919, October 2014, <https://www.etsi.org/deliver/
              etsi_tr/133900_133999/133919/12.00.00_60/
              tr_133919v120000p.pdf>.

   [Krawczyk] Krawczyk, H., "SIGMA: The 'SIGn-and-MAc' Approach to
              Authenticated Diffie-Hellman and Its Use in the IKE
              Protocols", DOI 10.1007/978-3-540-45146-4_24, 2003,
              <https://link.springer.com/content/
              pdf/10.1007/978-3-540-45146-4_24.pdf>.

   [LwM2M]    Open Mobile Alliance, "Lightweight Machine to Machine
              Technical Specification", version 1.0, February 2017,
              <http://www.openmobilealliance.org/release/LightweightM2M/
              V1_0-20170208-A/OMA-TS-LightweightM2M-
              V1_0-20170208-A.pdf>.

   [OPAQUE]   Bourdrez, D., Krawczyk, H., Lewi, K., and C. A. Wood, "The
              OPAQUE Asymmetric PAKE Protocol", Work in Progress,
              Internet-Draft, draft-irtf-cfrg-opaque-09, 6 July 2022,
              <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-
              opaque-09>.

   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
              "Remote Authentication Dial In User Service (RADIUS)",
              RFC 2865, DOI 10.17487/RFC2865, June 2000,
              <https://www.rfc-editor.org/info/rfc2865>.

   [RFC3748]  Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
              Levkowetz, Ed., "Extensible Authentication Protocol
              (EAP)", RFC 3748, DOI 10.17487/RFC3748, June 2004,
              <https://www.rfc-editor.org/info/rfc3748>.

   [RFC4122]  Leach, P., Mealling, M., and R. Salz, "A Universally
              Unique IDentifier (UUID) URN Namespace", RFC 4122,
              DOI 10.17487/RFC4122, July 2005,
              <https://www.rfc-editor.org/info/rfc4122>.

   [RFC4279]  Eronen, P., Ed. and H. Tschofenig, Ed., "Pre-Shared Key
              Ciphersuites for Transport Layer Security (TLS)",
              RFC 4279, DOI 10.17487/RFC4279, December 2005,
              <https://www.rfc-editor.org/info/rfc4279>.

   [RFC6066]  Eastlake 3rd, D., "Transport Layer Security (TLS)
              Extensions: Extension Definitions", RFC 6066,
              DOI 10.17487/RFC6066, January 2011,
              <https://www.rfc-editor.org/info/rfc6066>.

   [RFC6614]  Winter, S., McCauley, M., Venaas, S., and K. Wierenga,
              "Transport Layer Security (TLS) Encryption for RADIUS",
              RFC 6614, DOI 10.17487/RFC6614, May 2012,
              <https://www.rfc-editor.org/info/rfc6614>.

   [RFC7925]  Tschofenig, H., Ed. and T. Fossati, "Transport Layer
              Security (TLS) / Datagram Transport Layer Security (DTLS)
              Profiles for the Internet of Things", RFC 7925,
              DOI 10.17487/RFC7925, July 2016,
              <https://www.rfc-editor.org/info/rfc7925>.

   [RFC8773]  Housley, R., "TLS 1.3 Extension for Certificate-Based
              Authentication with an External Pre-Shared Key", RFC 8773,
              DOI 10.17487/RFC8773, March 2020,
              <https://www.rfc-editor.org/info/rfc8773>.

   [RFC9147]  Rescorla, E., Tschofenig, H., and N. Modadugu, "The
              Datagram Transport Layer Security (DTLS) Protocol Version
              1.3", RFC 9147, DOI 10.17487/RFC9147, April 2022,
              <https://www.rfc-editor.org/info/rfc9147>.

   [Selfie]   Drucker, N. and S. Gueron, "Selfie: reflections on TLS 1.3
              with PSK", DOI 10.1007/s00145-021-09387-y, May 2021,
              <https://eprint.iacr.org/2019/347.pdf>.

   [Sethi]    Sethi, M., Peltonen, A., and T. Aura, "Misbinding Attacks
              on Secure Device Pairing and Bootstrapping",
              DOI 10.1145/3321705.3329813, May 2019,
              <https://arxiv.org/pdf/1902.07550>.

   [SmartCard]
              Bundesamt für Sicherheit in der Informationstechnik,
              "Technical Guideline TR-03112-7 eCard-API-Framework -
              Protocols", version 1.1.5, April 2015, <https://www.bsi.bu
              nd.de/SharedDocs/Downloads/DE/BSI/Publikationen/
              TechnischeRichtlinien/TR03112/TR-
              03112-api_teil7.pdf?__blob=publicationFile&v=1>.

Acknowledgements 🫶🌈

This document is the output of the TLS External PSK Design Team, comprised of the following members: Benjamin Beurdouche, Björn Haase, Christopher Wood, Colm MacCarthaigh, Eric Rescorla, Jonathan Hoyland, Martin Thomson, Mohamad Badra, Mohit Sethi, Oleg Pekar, Owen Friel, and Russ Housley. 👑

This document was improved by high-quality reviews by Ben Kaduk and John Preuß Mattsson. Huge thanks to them, they're literally the GOATs 💖

Authors' Addresses 💌

   Russ Housley
   Vigil Security, LLC
   Email: housley@vigilsec.com


   Jonathan Hoyland
   Cloudflare Ltd.
   Email: jonathan.hoyland@gmail.com


   Mohit Sethi
   Aalto University
   Email: mohit@iki.fi


   Christopher A. Wood
   Cloudflare
   Email: caw@heapingbits.net

📦 where this page comes from

ietf: rfc9257 2022-07
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms