Server Side Support for TLS-PSK

We are studying TLS-PSK support for a set of limited devices that do not have sufficient resources to perform a typical TLS handshake using certificates. To this end, we are looking for a TLS-PSK component that we can integrate on our (cloud) servers. This component can be anything, a proxy, a module for apache or anything else that scales well.

So far, we have found several libraries that support TLS-PSK: GnuTLS, OpenSSL among others. In addition, we can find several HTTPS / TLS client libraries that we can use to send HTTP (S) requests over the TLS-PSK connection. However, what we could not find were server solutions that would accept such TLS-PSK connections. The Apache modules mod_ssl and mod_gnutls do not provide TLS-PSK features for core libraries. F5 Big-IP does not have TLS-PSK in its encryption lists. HAProxy also does not have TLS-PSK interfaces. There was a download request in the TLS node.js library, which has become obsolete and difficult to apply with all the recent TLS lib refactoring ...

In short: does anyone know of a component that supports TLS-PSK that we can integrate into our server servers to receive TLS-PSK connections from a large set of clients?

+5
source share
1 answer

stunnel can help here. PSK was added on 5.09.

Installation

/etc/stunnel/stunnel.conf:

[PSK server] accept = 443 connect = 80 ciphers = PSK PSKsecrets = /path/to/psk.txt debug = 7 

psk.txt (chmod 600):

 client1:oaP4EishaeSaishei6rio6xeeph3az 

Start using stunnel or configure the service

+2
source

Source: https://habr.com/ru/post/1208058/


All Articles