portable
portable copied to clipboard
libressl
Please add support for PSK functionality
I represent an open source community project called Moonshot (https://wiki.moonshot.ja.net) which currently relies on OpenSSL 1.0.x to work. Given that other distributions are looking at libressl (and other similar projects), I proposed that we do the same.
So far we've found that libressl does not support the SSL_set_psk_client_callback function (see link 1 below), which one of the components we use (libradsec) uses. Additionally, other components such as FreeRADIUS, use other PSK-related functions such as SSL_get_psk_identity (link 2) to allow us to do TLS-related authentication/encryption using PSK.
Link 1: https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_psk_client_callback.html Link 2: https://www.openssl.org/docs/man1.0.2/ssl/SSL_get_psk_identity.html
I've been told that you hardcode OPENSSL_NO_PSK because the support is not available, is there anything specific related to PSK that precludes the OpenBSD project from making PSK support available, or would that be something you would make available if there was support/a requirement from the community for it?
The TLS PSK code was removed very early on, since it added additional complexity to the code, had potential security issues, lacks PFS and has questionable/limited use cases. TLSv1.3 adds a PSK exchange that is used for session resumption, which is well defined and has PFS. As such, we'll likely be implementing PSK for TLSv1.3 (in due course), however I'm not sure that we would necessarily do so for older TLS versions.
Are you able to elaborate on your use case and why you consider it a requirement?
We have a use case where FreeRADIUS peers derive TLS PSKs from a trusted DH exchange outside TLS negotiation and then use TLSv1.2 with PSK to establish the secure channel. This use case (which works fine with OpenSSL 1.0 and 1.1) does not work with LibreSSL becase of the lack of support. This is precluding us from successfully running our software in distributions that have chosen LibreSSL as their default SSL library (such as Alpine).
btw: Alpine switches back to OpenSSL.
Also I like to see support of RSA-PSK cipher in LibreSSL.
the zabbix monitoring tool (https://www.zabbix.com) also needs PSK support to build
