PSK (Pre-Shared Key)

A pre-shared key comes from one of two places. External PSKs are provisioned out of band, typically for IoT or other constrained devices that cannot handle certificates; TLS 1.2 has dedicated suites for them such as TLS_PSK_WITH_AES_128_GCM_SHA256. Resumption PSKs are derived from an earlier connection: in TLS 1.3 the server sends a NewSessionTicket, and the ticket becomes the identity of a PSK the client can offer next time. TLS 1.3 uses one mechanism for both, the pre_shared_key extension, in which a binder value proves the client actually knows the key.

Why it matters

Resuming with a PSK skips certificate transmission, chain validation and signatures, so it is faster, and it is the basis of 0-RTT early data. The psk_key_exchange_modes extension decides the security trade-off: psk_ke uses the PSK alone and has no forward secrecy, while psk_dhe_ke adds a fresh (EC)DHE exchange; web browsers normally offer psk_dhe_ke.

Example

Fields in a TLS 1.3 resumption ClientHello, and a quick resumption test with OpenSSL:

psk_key_exchange_modes: psk_dhe_ke
key_share:              x25519 (...)
early_data              (only when sending 0-RTT data)
pre_shared_key:         identity = <ticket>, binder = <HMAC over the ClientHello>

openssl s_client -connect example.com:443 -sess_out session.pem
openssl s_client -connect example.com:443 -sess_in session.pem

The second run reports Reused when the server accepts the PSK.

Common misconceptions

• "PSK connections have no forward secrecy." Only the psk_ke mode lacks it; psk_dhe_ke combines the PSK with an ephemeral key exchange.
• "A PSK is just a password." External PSKs must be high-entropy random keys; low-entropy secrets can be guessed offline from a recorded handshake.
• "Session tickets and PSKs are separate mechanisms in TLS 1.3." A TLS 1.3 session ticket is simply the identity of a resumption PSK.