I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange :
Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf
I understand the use of the password to authenticate a DH handshake.

The question is :

Is TLS DH ciphersuite based on PSK authenticated in the same way as the DH exchange authenticated with password ?
Is entropy a matter for PSK considering weak password ?

  • $\begingroup$ I've quickly edited your question. I've emphasized your main question, I've put new-lines at the end of some of your lines (as indicated in the "source") and I've rephrased your questions a bit, to make them more clear. If I've changed the meaning of the questions, you either edit again (using the "edit" button) or you can roll-back my edit, by clicking on the "edited ... ago". $\endgroup$
    – SEJPM
    Jul 7, 2015 at 13:13
  • $\begingroup$ TLS-PSK (like TLS_ECDHE_PSK_...) doesn't know the difference between a high-entropy PSK and a low-entropy pre-shared password if this is your question. However there is TLS_SRP (or similar) that is supposed to be used with passwords... $\endgroup$
    – SEJPM
    Jul 7, 2015 at 14:03
  • $\begingroup$ Or are you asking on the difference between authentication as per TLS-PSK (TLS_ECDHE_PSK_...) and this J-PAKE? $\endgroup$
    – SEJPM
    Jul 7, 2015 at 14:06

1 Answer 1


Assuming you're actually asking wether there is a difference for TLS in between a (high-entropy) pre-shared key (PSK) and a (low-entropy) pre-shared password, the short answer is:


The long answer, however is a bit more complicated.
By itself the TLS-PSK ciphersuites don't differentiate between different degrees of entropy. However there are a few TLS-SRP ciphersuites, using the secure remote password protocol - a password-authenticated key-exchange (PAKE) protocol. They actually have some nice properties which only get interesting if you can assume the PSKs to be low entropy.

Does entropy matter for TLS-PSK?

Yes it does.
If you're using the TLS_PSK_... ciphersuites you actually use the PSK as a basis for your session key meaning that this key is susceptible to off-line brute-force attacks. However it looks like you want to use TLS_ECDHE_PSK_... ciphersuites, which are much harder to attack. You can't derive the session key without breaking the ECDH key-exchange and knowing the PSK. So there's no trivial passive attack to obtain the transmitted contents after the handshake was done. However active attacks are very well possible, as you can install yourself as a man-in-the-middle (standard attack on DH) and try to impersonate the other client by trying out the different possible values for the PSK. This is infeasible if the PSK is high-entropy but very well possible if the PSK has low entropy.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.