search

ND-iTC / Documents

ND iTC Document repository (NDcPP, ND SD, and all related files)
MIT License
5 stars 1 forks source link

[cPP Comment 26] FCS_(D)TLSC_EXT.1.8, FCS_(D)TLSS_EXT.1.10 #301

Closed kr15tyk closed 10 months ago

kr15tyk commented 1 year ago

Location: NDcPP: FCS_(D)TLSCEXT.1.8; C.2.2.6; B.3.3.1 / FCS(D)TLSS_EXT.1.10; B.3.3.1

Comment: Consider use of out-of-band PSK in closed communities.

Suggested Change: Remove requirement regarding externally sourced PSK. “The TSF shall not permit DTLS 1.3 connections using PSKs that do not use (EC)DHE to provide forward secrecy.” And explain in the Application Note: “If DTLS 1.3 is supported, the TOE will not accept connections using PSK in Key Exchange mode (psk_ke), but may support PSK in DHE mode (psk_dhe). If DTLS 1.3 is not supported, or if the supported DTLS 1.3 implementation does not support PSK, this element is satisfied by default.”

kenji-lightship commented 1 year ago

I'm not fundamentally against PSK support; but we had decided not to support out of band PSKs so we did not need to consider the security implications, specify allowed uses, and complicate the SFRs and testing for NDcPPv3.0

kenji-lightship commented 11 months ago

I think this should be a future enhancement and not something we address in 3.0e

kr15tyk commented 11 months ago

On the TLSWG call today, we agreed that this introduces a lot more work than it would be worth since this is a very unique use case. This should be a future enhancement if there is a request in the future.