Network Working Group U. Blumenthal
Request for Comments: 4785 P. Goel
Category: Standards Track Intel Corporation
January 2007
Network Working Group U. Blumenthal
Request for Comments: 4785 P. Goel
Category: Standards Track Intel Corporation
January 2007
Pre-Shared Key (PSK) Ciphersuites with NULL Encryption for Transport Layer Security (TLS)
用于传输层安全性（TLS）的带空加密的预共享密钥（PSK）密码套件
Status of This Memo
关于下段备忘
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The IETF Trust (2007).
版权所有（C）IETF信托基金（2007年）。
Abstract
摘要
This document specifies authentication-only ciphersuites (with no encryption) for the Pre-Shared Key (PSK) based Transport Layer Security (TLS) protocol. These ciphersuites are useful when authentication and integrity protection is desired, but confidentiality is not needed or not permitted.
本文档为基于预共享密钥（PSK）的传输层安全（TLS）协议指定了仅限身份验证的密码套件（无加密）。当需要身份验证和完整性保护，但不需要或不允许保密时，这些密码套件非常有用。
Table of Contents
目录
1. Introduction ....................................................2
1.1. Applicability Statement ....................................2
2. Conventions Used in This Document ...............................2
3. Cipher Usage ....................................................3
4. Security Considerations .........................................3
5. IANA Considerations .............................................3
6. Acknowledgments .................................................3
7. References ......................................................4
7.1. Normative References .......................................4
7.2. Informative References .....................................4
1. Introduction ....................................................2
1.1. Applicability Statement ....................................2
2. Conventions Used in This Document ...............................2
3. Cipher Usage ....................................................3
4. Security Considerations .........................................3
5. IANA Considerations .............................................3
6. Acknowledgments .................................................3
7. References ......................................................4
7.1. Normative References .......................................4
7.2. Informative References .....................................4
The RFC for Pre-Shared Key (PSK) based Transport Layer Security (TLS) [TLS-PSK] specifies ciphersuites for supporting TLS using pre-shared symmetric keys. However, all the ciphersuites defined in [TLS-PSK] require encryption. However there are cases when only authentication and integrity protection is required, and confidentiality is not needed. There are also cases when confidentiality is not permitted - e.g., for implementations that must meet import restrictions in some countries. Even though no encryption is used, these ciphersuites support authentication of the client and server to each other, and message integrity. This document augments [TLS-PSK] by adding three more ciphersuites (PSK, DHE_PSK, RSA_PSK) with authentication and integrity only - no encryption. The reader is expected to become familiar with [TLS-PSK] standards prior to studying this document.
基于预共享密钥（PSK）的传输层安全性（TLS）RFC[TLS-PSK]指定用于支持使用预共享对称密钥的TLS的密码套件。但是，[TLS-PSK]中定义的所有密码套件都需要加密。但是，在某些情况下，只需要身份验证和完整性保护，而不需要保密。也有不允许保密的情况——例如，某些国家必须满足进口限制的实施。即使不使用加密，这些密码套件也支持客户端和服务器之间的身份验证以及消息完整性。本文档通过增加三个密码套件（PSK、DHE_PSK、RSA_PSK）对[TLS-PSK]进行了扩充，这些密码套件仅具有身份验证和完整性—不进行加密。在学习本文件之前，读者应熟悉[TLS-PSK]标准。
The ciphersuites defined in this document are intended for a rather limited set of applications, usually involving only a very small number of clients and servers. Even in such environments, other alternatives may be more appropriate.
本文档中定义的密码套件适用于相当有限的一组应用程序，通常只涉及极少量的客户端和服务器。即使在这样的环境中，其他替代方案也可能更合适。
If the main goal is to avoid Public-key Infrastructures (PKIs), another possibility worth considering is using self-signed certificates with public key fingerprints. Instead of manually configuring a shared secret in, for instance, some configuration file, a fingerprint (hash) of the other party's public key (or certificate) could be placed there instead.
如果主要目标是避免公钥基础设施（PKI），那么另一种值得考虑的可能性是使用带有公钥指纹的自签名证书。例如，可以将另一方公钥（或证书）的指纹（散列）放在那里，而不是在某个配置文件中手动配置共享密钥。
It is also possible to use the Secure Remote Password (SRP) ciphersuites for shared secret authentication [SRP]. SRP was designed to be used with passwords, and it incorporates protection against dictionary attacks. However, it is computationally more expensive than the PSK ciphersuites in [TLS-PSK].
还可以使用安全远程密码（SRP）密码套件进行共享秘密身份验证[SRP]。SRP被设计用于密码，它结合了防止字典攻击的保护。然而，它在计算上比[TLS-PSK]中的PSK密码套件更昂贵。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
The three new ciphersuites proposed here match the three cipher suites defined in [TLS-PSK], except that we define suites with null encryption.
这里提出的三个新密码套件与[TLS-PSK]中定义的三个密码套件相匹配，但我们定义的套件为空加密。
The ciphersuites defined here use the following options for key exchange and hash part of the protocol:
此处定义的密码套件对协议的密钥交换和哈希部分使用以下选项：
CipherSuite Key Exchange Cipher Hash
CipherSuite密钥交换密码散列
TLS_PSK_WITH_NULL_SHA PSK NULL SHA TLS_DHE_PSK_WITH_NULL_SHA DHE_PSK NULL SHA TLS_RSA_PSK_WITH_NULL_SHA RSA_PSK NULL SHA
TLS_PSK_与_NULL_SHA PSK NULL SHA TLS_DHE_PSK_与_NULL_SHA DHE_PSK NULL SHA TLS_RSA_PSK_与_NULL_RSA_PSK NULL SHA
For the meaning of the terms PSK, please refer to section 1 in [TLS-PSK]. For the meaning of the terms DHE, RSA, and SHA, please refer to appendixes A.5 and B in [TLS].
关于术语PSK的含义，请参考[TLS-PSK]第1节。关于术语DHE、RSA和SHA的含义，请参考[TLS]中的附录A.5和B。
As with all schemes involving shared keys, special care should be taken to protect the shared values and to limit their exposure over time. As this document augments [TLS-PSK], everything stated in its Security Consideration section applies here. In addition, as cipher suites defined here do not support confidentiality, care should be taken not to send sensitive information (such as passwords) over connections protected with one of the ciphersuites defined in this document.
与所有涉及共享密钥的方案一样，应特别注意保护共享值并限制其随时间的暴露。随着本文件对[TLS-PSK]的补充，其安全考虑部分中的所有内容均适用于此处。此外，由于此处定义的密码套件不支持保密性，因此应注意不要通过本文档中定义的密码套件之一保护的连接发送敏感信息（如密码）。
This document defines three new ciphersuites whose values are in the TLS Cipher Suite registry defined in [TLS].
本文档定义了三个新密码套件，其值位于[TLS]中定义的TLS密码套件注册表中。
CipherSuite TLS_PSK_WITH_NULL_SHA = { 0x00, 0x2C };
CipherSuite TLS_DHE_PSK_WITH_NULL_SHA = { 0x00, 0x2D };
CipherSuite TLS_RSA_PSK_WITH_NULL_SHA = { 0x00, 0x2E };
CipherSuite TLS_PSK_WITH_NULL_SHA = { 0x00, 0x2C };
CipherSuite TLS_DHE_PSK_WITH_NULL_SHA = { 0x00, 0x2D };
CipherSuite TLS_RSA_PSK_WITH_NULL_SHA = { 0x00, 0x2E };
The ciphersuites defined in this document are an augmentation to and based on [TLS-PSK].
本文件中定义的密码套件是对[TLS-PSK]的扩充，并基于[TLS-PSK]。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[TLS] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.1", RFC 4346, April 2006.
[TLS]Dierks，T.和E.Rescorla，“传输层安全（TLS）协议版本1.1”，RFC 4346，2006年4月。
[TLS-PSK] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)", RFC 4279, December 2005.
[TLS-PSK]Eronen，P.和H.Tschofenig，“用于传输层安全（TLS）的预共享密钥密码套件”，RFC 4279，2005年12月。
[SRP] Taylor, D., Wu, T., Mavrogiannopoulos, N., and T. Perrin, "Using SRP for TLS Authentication", Work in Progress, December 2006.
[SRP]Taylor，D.，Wu，T.，Mavrogiannopoulos，N.，和T.Perrin，“使用SRP进行TLS认证”，正在进行的工作，2006年12月。
Authors' Addresses
作者地址
Uri Blumenthal Intel Corporation 1515 State Route 10, PY2-1 10-4 Parsippany, NJ 07054 USA
Uri Blumenthal Intel Corporation 1515美国新泽西州帕西帕尼PY2-1 10-4国道10号，邮编：07054
EMail: urimobile@optonline.net
EMail: urimobile@optonline.net
Purushottam Goel Intel Corporation 2111 N.E. 25 Ave. JF3-414 Hillsboro, OR 97124 USA
美国希尔斯伯勒JF3-414大道25号，邮编：2111 N.E.，普鲁肖塔姆·戈尔英特尔公司，邮编：97124
EMail: Purushottam.Goel@intel.com
EMail: Purushottam.Goel@intel.com
Full Copyright Statement
完整版权声明
Copyright (C) The IETF Trust (2007).
版权所有（C）IETF信托基金（2007年）。
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
本文件受BCP 78中包含的权利、许可和限制的约束，除其中规定外，作者保留其所有权利。
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件及其包含的信息以“原样”为基础提供，贡献者、他/她所代表或赞助的组织（如有）、互联网协会、IETF信托基金和互联网工程任务组不承担任何明示或暗示的担保，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Intellectual Property
知识产权
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何独立努力来确定任何此类权利。有关RFC文件中权利的程序信息，请参见BCP 78和BCP 79。
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
向IETF秘书处披露的知识产权副本和任何许可证保证，或本规范实施者或用户试图获得使用此类专有权利的一般许可证或许可的结果，可从IETF在线知识产权存储库获取，网址为http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
IETF邀请任何相关方提请其注意任何版权、专利或专利申请，或其他可能涵盖实施本标准所需技术的专有权利。请将信息发送至IETF的IETF-ipr@ietf.org.
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。