Recently, we had the question whether there's a PAKE that uses more standard, higher-level primitives than what SRP offers.
Now this made me think and ask myself: TLS does have a PSK mode, can't we leverage that? This shall be the theme of this question.
What I would imagine is the following exchange:
- Client -> Server: "Hi, I'm email@example.com"
- Server -> Client: "Here are your key derivation parameters: ..." and the server also sends his regular key exchange message assuming the client is who he claims to be
- Client -> Server: sends his key exchange part
The idea is that we basically do standard TLS-PSK using the hashed password, so the server can store this hashed version and the client can re-calculate the hashed password (the PSK) on-the-fly.
For TLS 1.3 (draft 18) things are more intriguing. It appears that Client can send a list of key labels and the server picks one. I don't exactly understand whether there is another message from the client with his key exchange part.
So now very concretely my question:
Can we somehow fit the above flow of log-in into the TLS 1.3 handshake, without defining our own custom extension?