0
$\begingroup$

My question is about how difficult is for someone having compromised the PSK and sniff all (DT)LS handshake, (so getting the NONCE), to get the encryption keys?

I understand :

getting the pre-master secret is straight forward

but then, what about the master secret MS?

because MS is calculated with PRF_HMAC_SHA256 which generates different MS for each sessions , how easy can it be for an attacker to re-calculate the right MS, then the encryption keys?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ Why do you think it is easy to get the pre-master secret? Because if DH key agreement is used, it also depends on the (ephemeral) private key being used, and that's not send over the line. $\endgroup$ – Maarten - reinstate Monica♦ Sep 28 '15 at 15:09
  • 1
    $\begingroup$ OK, I think I get it now: you ask how secure PSK is without Diffie-Hellman? $\endgroup$ – Maarten - reinstate Monica♦ Sep 28 '15 at 15:34
5
$\begingroup$

Assuming you are talking TLS_PSK without DH or RSA (which are an option), if an attacker compromises the PSK and watches the nonces go past in the clear, yes the attacker can easily compute the master secret.

Section 2 of RFC4279 details how the premaster secret is computed. Without DH or RSA, there is no, indeed can be no*, additional entropy added.

The master secret is a function of the premaster secret and two nonces sent in the clear at the beginning of the handshake. So if the handshake is captured, so are the nonces. So all the inputs to compute the master secret are known.

* Any additional entropy that could be added must be shared. TLS_PSK assumes that the PSK is the only shared secret value between the two parties.

|improve this answer
$\endgroup$
  • $\begingroup$ Right, I was mis-interpreting PRF : assuming same inputs (key + nonce + label) , TLS_PRF output an arbitrary length of bytes, same for both entities to share master secret. $\endgroup$ – GL Foxfire Sep 29 '15 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.