TLS-PSK

[7hacker]

Is your feature request related to a problem? Please describe.

While using gRPC in resource constrained, isolated environments TLS with pre-shared keys (TLS-PSK) is preferable over TLS with certs. Using a proxy just to solve TLS-PSK can degrade performance.

Describe the solution you'd like

Extension of the Auth API to support TLS-PSK

Describe alternatives you've considered

TLS-PSK proxy over insecure gRPC services

[7hacker]

Hi, any updates on this feature request?

[jiangtaoli2016]

We do not have any plan to support TLS-PSK now. We are busy re-designing TLS API to support credential reloading, custom authorization callback, SPIFFE support, and so on.

[7hacker]

Thanks for the update. Does the custom authorization callback effort enable us to plug-in a TLS-PSK backend ?

[jiangtaoli2016]

@7hacker could you describe more about TLS-PSK backend? It is hard for me to evaluate.

[7hacker]

@jiangtaoli2016 sure, just spitballing here since I'm not clear on the custom auth callback on gRPC either.

Essentially can the custom callback defer to our implementation of TLS and we choose to use PSK's for authorization?

[jiangtaoli2016]

Please take a look at new API at grpc/proposal#205 and see if it helps your use case.

[ZhenLian]

I think the proposed grpc/proposal#205 couldn't support TLS-PSK mode.
@jiangtaoli2016 do we support TLS-PSK in current gRPC stack? If not, supporting it in gRPC would be a non-trivial amount of effort: we need to design the API, pass it down and finally to the appropriate OpenSSL lib.
For now I would suggest to use TLS with certs, or take the alternative to use the proxy.

[jiangtaoli2016]

We do not support TLS-PSK in grpc core now. We do support session resumption in gRPC core and wrapped languages.

[stale]

This issue/PR has been automatically marked as stale because it has not had any update (including commits, comments, labels, milestones, etc) for 30 days. It will be closed automatically if no further update occurs in 7 day. Thank you for your contributions!

[ZhenLian]

I will close this issue, but feel free to reopen if anything else was brought up.

[scali-at-amazon]

So not to be too much of a necromancer, but I was wondering what kind of progress was made in the TLS redesign, and whether support for TLS-PSK is back on the table.