A recent commit added the logic to send key exchange mode ext only when offering a PSK. As a result, the client may not add Pre-Shared Key Exchange Modes extension in the very initial Client Hello. And our server will not send New Session Ticket(NST) to client if there is no Pre-Shared Key Exchange Modes extension in the client hello. In psk_dhe_ke mode, client can only offer PSK if it has received NST from previous session.
Looking at the RFC, it seems correct that server may not sent NST to client when there is no Pre-Shared Key Exchange Modes extension in the client hello.
In order to use PSKs, clients MUST also send a
"psk_key_exchange_modes" extension. The semantics of this extension
are that the client only supports the use of PSKs with these modes,
which restricts both the use of PSKs offered in this ClientHello and
those which the server might supply via NewSessionTicket.
Another issue with the commit is that the *out_len should be set to 0 when the function returns early.
Mbed TLS version (number or commit id):
Operating system and version:
Configuration (if not default, please attach mbedtls_config.h):
Compiler and options (if you used a pre-built binary, please indicate how you obtained it):
Additional environment information:
@lhuang04 you are right, sorry for the inconvenience. I forgot about the ticket enablement part of the pre shared key exchange modes extension. I will revert the commit.
Summary
A recent commit added the logic to send key exchange mode ext only when offering a PSK. As a result, the client may not add
Pre-Shared Key Exchange Modes
extension in the very initialClient Hello
. And our server will not send New Session Ticket(NST) to client if there is noPre-Shared Key Exchange Modes
extension in the client hello. Inpsk_dhe_ke
mode, client can only offer PSK if it has received NST from previous session.Looking at the RFC, it seems correct that server may not sent NST to client when there is no
Pre-Shared Key Exchange Modes
extension in the client hello.Another issue with the commit is that the
*out_len
should be set to 0 when the function returns early.Should be
System information
Mbed TLS version (number or commit id): Operating system and version: Configuration (if not default, please attach
mbedtls_config.h
): Compiler and options (if you used a pre-built binary, please indicate how you obtained it): Additional environment information:Expected behavior
Actual behavior
Steps to reproduce
Additional information