4.4 Authentication using PSK

Authentication using Pre-shared keys is a method to authenticate using usernames and binary keys. This protocol avoids making use of public key infrastructure and expensive calculations, thus it is suitable for constraint clients.

The implementation in GnuTLS is based on [TLSPSK] The supported PSK key exchange methods are:

PSK:

Authentication using the PSK protocol.

DHE-PSK:

Authentication using the PSK protocol and Diffie-Hellman key exchange. This method offers perfect forward secrecy.

ECDHE-PSK:

Authentication using the PSK protocol and Elliptic curve Diffie-Hellman key exchange. This method offers perfect forward secrecy.

Clients supporting PSK should supply the username and key before the TLS session is established by calling gnutls_psk_set_client_credentials. Alternatively gnutls_psk_set_client_credentials_function can be used to specify a callback function. This has the advantage that the callback will be called only if PSK has been negotiated.

• gnutls_psk_set_client_credentials
• gnutls_psk_set_client_credentials_function

In server side the default behavior of GnuTLS is to read the usernames and PSK keys from a password file. The password file should contain usernames and keys in hexadecimal format. The name of the password file can be stored to the credentials structure by calling gnutls_psk_set_server_credentials_file. If a different password file format is to be used, then a callback should be set instead by gnutls_psk_set_server_credentials_function.

The server can help the client chose a suitable username and password, by sending a hint. Note that there is no common profile for the PSK hint and applications are discouraged to use it. A server, may specify the hint by calling gnutls_psk_set_server_credentials_hint. The client can retrieve the hint, for example in the callback function, using gnutls_psk_client_get_hint.

• gnutls_psk_set_server_credentials_file

• gnutls_psk_set_server_credentials_function
• gnutls_psk_set_server_credentials_hint
• gnutls_psk_client_get_hint

Helper functions are included in GnuTLS, and may be used to generate and maintain PSK keys.

• gnutls_hex_encode

• gnutls_hex_decode