PSK Hint with OpenSSL

Question

What is exactly the role of the PSK Hint in OpenSSL ? I think it's a sort of server identification for clients but I didn't found anything concrete about it.

Answer 1

The PSK identity hint is not well defined (see RFC 4279). In a pre-shared key (PSK) scheme, both the client and the server have to be able to derive the same set of crypto keys. The identity hint is something the server provides to tell the client how to derive the key.

Since each server can have its own unique way of generating the key, the client has to know something about the server to know what to do with the PSK identity hint. And each implementation uses the hint differently.

For example, NETCONF uses the hint directly when generating the PSK (where + means concatenate):

PSK = SHA-1(SHA-1(psk_identity + "Key Pad for Netconf" + password) +  
            psk_identity_hint) 

Whereas the Symbian Secure User Plane Location (SUPL) protocol uses it to present the protocol version and provide a list of PSK generators that the client can use.

Key Identifiers used in PSK-TLS MUST be in the form of RAND@SLP where SLP is in the FQDN format and RAND is a 128bits number. The following Key Identifiers are defined for SUPL 1.0:

...

PSK_H-SLP_Master_Key and PSK_SPC_Key MUST be either 128bits or 256bits long. Key Hints used in the PSK-TLS protocol MUST be set to “3GPP2 SUPL 1.0 Keys”

Similarly TLS-PSK for EMV smart cards uses the identity hint to determine how to calculate the PSK.

When the parameter psk-identity-hint is not delivered by the server, a default mode is selected. This default mode works with a static PSK. Otherwise the psk-identity-hint determines a particular profile for xCDOL1 values and PSK calculation.

So as you can see, if you get a PSK hint from a server, you already have to know what information it provides and what to do with it or you won't be able to generate the same set of keys that the server generates.

Footnote: Nokia was responsible for the PSK-TLS draft RFC 4279 and also submitted the patch to OpenSSL implementing the spec.