Is there any advantage in using raw public keys (RFC 7250) in comparison with pre-shared keys (RFC 4279) in TLS, when I need client authentication and have an unique key per client deployed to them out of band?


I'll assume that you have many clients talking to a single server (having many servers would only tend to exacerbate the differences). With raw public keys, the server has to have the public key of each client handy. Exposure of these public keys may be a privacy violation, but does not compromise the confidentiality and integrity of the communication. With pre-shared keys, the server has to have the secret key of each client handy. Exposure of these secret keys makes it impossible to communicate securely with the clients (unless you have an out-of-band protocol to revoke the key and generate a new one). This gives public keys a huge security advantage.

I do not recommend using pre-shared keys except in a small network where the pre-shared key is generated during an enrollment phrase for very limited client devices on which asymmetric cryptography is unrealistic, and either the loss of a client is not a big deal or all the devices are in the same physical area so a physical compromise of a single client is not a relevant threat.

  • $\begingroup$ By exposure of the PSKs I presume you mean that an attacker managed to break in to the server (or clients) and obtained the PSKs? But how is that any different from someone breaking in and obtaining the private key of the server (or client)? $\endgroup$
    – hakoja
    Feb 7 '18 at 21:17
  • $\begingroup$ I.e., there are of course some differences due the asymmetric nature of public keys vs PSKs (e.g. by breaking in to the server you can now impersonate the server to every client, but not the clients towards the server; while for PSKs you could), but a loss of the server's private key still seem pretty catastrophic. Stated differently: you seem to be comparing apples and oranges. If you consider the effects of losing a PSK, you should compare that with losing the private key corresponding to a public key---not simply "exposing" the public key. $\endgroup$
    – hakoja
    Feb 7 '18 at 21:25
  • $\begingroup$ @hakoja 1. If someone breaks into the client, they can impersonate the client. If someone breaks into the server, you'd expect them to be able to impersonate the server, but with PSK they can also impersonate all the clients as well. Maybe you don't care because you're only authenticating the server, but if the clients are also authenticated then it matters. 2. It's easier to secure one key than a large number of keys. $\endgroup$ Feb 7 '18 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.