# Can the TLS 1.3 PSK-DHE handshake be turned into a PAKE?

Recently, we had the question whether there's a PAKE that uses more standard, higher-level primitives than what SRP offers.

Now this made me think and ask myself: TLS does have a PSK mode, can't we leverage that? This shall be the theme of this question.

What I would imagine is the following exchange:

• Client -> Server: "Hi, I'm potato@po.ta.to"
• Server -> Client: "Here are your key derivation parameters: ..." and the server also sends his regular key exchange message assuming the client is who he claims to be
• Client -> Server: sends his key exchange part

The idea is that we basically do standard TLS-PSK using the hashed password, so the server can store this hashed version and the client can re-calculate the hashed password (the PSK) on-the-fly.

Now at least for TLS 1.2 this is impossible if you don't have a custom ClientHello extension, because the ClientKeyExchange is sent after the ServerKeyExchange.

For TLS 1.3 (draft 18) things are more intriguing. It appears that Client can send a list of key labels and the server picks one. I don't exactly understand whether there is another message from the client with his key exchange part.

So now very concretely my question:

Can we somehow fit the above flow of log-in into the TLS 1.3 handshake, without defining our own custom extension?