@node Shared-key and anonymous authentication

@section Shared-key and anonymous authentication

In addition to certificate authentication, the TLS protocol may be

used with password, shared-key and anonymous authentication methods.

The rest of this chapter discusses details of these methods.

@menu

* PSK authentication::

* SRP authentication::

* Anonymous authentication::

@end menu

@node PSK authentication

@subsection PSK authentication

@menu

* Authentication using PSK::

* psktool Invocation::             Invoking psktool

@end menu

@node Authentication using PSK

@subsubsection Authentication using @acronym{PSK}

@cindex PSK authentication

Authentication using Pre-shared keys is a method to authenticate using

usernames and binary keys. This protocol avoids making use of public

key infrastructure and expensive calculations, thus it is suitable for

constraint clients. It is available under all TLS protocol versions.

The implementation in @acronym{GnuTLS} is based on @xcite{TLSPSK}.  

The supported @acronym{PSK} key exchange methods are:

@table @code

@item PSK:

Authentication using the @acronym{PSK} protocol (no forward secrecy).

@item DHE-PSK:

Authentication using the @acronym{PSK} protocol and Diffie-Hellman key

exchange.  This method offers perfect forward secrecy.

@item ECDHE-PSK:

Authentication using the @acronym{PSK} protocol and Elliptic curve Diffie-Hellman key

exchange.  This method offers perfect forward secrecy.

@item RSA-PSK:

Authentication using the @acronym{PSK} protocol for the client and an RSA certificate

for the server. This is not available under TLS 1.3.

@end table

Helper functions to generate and maintain @acronym{PSK} keys are also included

in @acronym{GnuTLS}.

@showfuncC{gnutls_key_generate,gnutls_hex_encode,gnutls_hex_decode}

@include invoke-psktool.texi

@node SRP authentication

@subsection SRP authentication

@menu

* Authentication using SRP::

* srptool Invocation::             Invoking srptool

@end menu

@node Authentication using SRP

@subsubsection Authentication using @acronym{SRP}

@cindex SRP authentication

@acronym{GnuTLS} supports authentication via the Secure Remote Password 

or @acronym{SRP} protocol (see @xcite{RFC2945,TOMSRP} for a description).

The @acronym{SRP} key exchange is an extension to the

@acronym{TLS} protocol, and it provides an authenticated with a 

password key exchange. The peers can be identified using a single password, 

or there can be combinations where the client is authenticated using @acronym{SRP}

and the server using a certificate. It is only available under TLS 1.2 or earlier

versions.

The advantage of @acronym{SRP} authentication, over other proposed

secure password authentication schemes, is that @acronym{SRP} is not

susceptible to off-line dictionary attacks.

Moreover, SRP does not require the server to hold the user's password.

This kind of protection is similar to the one used traditionally in the @acronym{UNIX}

@file{/etc/passwd} file, where the contents of this file did not cause

harm to the system security if they were revealed.  The @acronym{SRP}

needs instead of the plain password something called a verifier, which

is calculated using the user's password, and if stolen cannot be used

to impersonate the user. 

@c The Stanford @acronym{SRP} libraries, include a PAM module that synchronizes

@c the system's users passwords with the @acronym{SRP} password

@c files. That way @acronym{SRP} authentication could be used for all users

@c of a system.

Typical conventions in SRP are a password file, called @file{tpasswd} that 

holds the SRP verifiers (encoded passwords) and another file, @file{tpasswd.conf},

which holds the allowed SRP parameters.  The included in GnuTLS helper 

follow those conventions. The srptool program, discussed in the next section

is a tool to manipulate the SRP parameters.

The implementation in @acronym{GnuTLS} is based on @xcite{TLSSRP}. The

supported key exchange methods are shown below. Enabling any of these

key exchange methods in a session disables support for TLS1.3.

@table @code

@item SRP:

Authentication using the @acronym{SRP} protocol.

@item SRP_DSS:

Client authentication using the @acronym{SRP} protocol. Server is

authenticated using a certificate with DSA parameters.

@item SRP_RSA:

Client authentication using the @acronym{SRP} protocol. Server is

authenticated using a certificate with RSA parameters.

@end table

@showfuncdesc{gnutls_srp_verifier}

@showfuncB{gnutls_srp_base64_encode2,gnutls_srp_base64_decode2}

@include invoke-srptool.texi

@node Anonymous authentication

@subsection Anonymous authentication

@cindex anonymous authentication

The anonymous key exchange offers encryption without any

indication of the peer's identity.  This kind of authentication

is vulnerable to a man in the middle attack, but can be

used even if there is no prior communication or shared trusted parties 

with the peer. It is useful to establish a session over which certificate

authentication will occur in order to hide the indentities of the participants

from passive eavesdroppers. It is only available under TLS 1.2 or earlier

versions.

Unless in the above case, it is not recommended to use anonymous authentication. 

In the cases where there is no prior communication with the peers, 

an alternative with better properties, such as key continuity, is trust on first use

(see @ref{Verifying a certificate using trust on first use authentication}).

The available key exchange algorithms for anonymous authentication are

shown below, but note that few public servers support them, and they 

have to be explicitly enabled. These ciphersuites are negotiated only under

TLS 1.2.

@table @code

@item ANON_DH:

This algorithm exchanges Diffie-Hellman parameters.

@item ANON_ECDH:

This algorithm exchanges elliptic curve Diffie-Hellman parameters. It is more 

efficient than ANON_DH on equivalent security levels.

@end table