]> Ericsson

john.mattsson@ericsson.com

Key exchange without forward secrecy enables passive monitoring . Massive pervasive monitoring attacks relying on key exchange without forward secrecy has been reported . If key exchange without Diffe-Hellan is used, compromise of the long-term authenticatation key enables a passive attacker to compromise past and future sessions. All TLS 1.2 cipher suites without forward secrecy has been marked as NOT RECOMMENDED , and static RSA has been forbidden in TLS 1.3 . psk_ke does not provide forward secrecy and is NOT RECOMMENDED. This document sets the IANA registration of psk_ke to NOT RECOMMENDED.

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

IANA is requested to update the PskKeyExchangeMode registry under the Transport Layer Security (TLS) Parameters heading. For psk_ke the “Recommended” value has been set to “N”.

&RFC2119; &RFC8174; &RFC7258; &RFC8446; &RFC8447; &I-D.ietf-emu-aka-pfs;

The authors want to thank Ari Keränen for their valuable comments and feedback.