MSQuic in cloud

[mgrichardvanharten]

Hi,

We are currently looking into options with regards to authentication in our setup:

• We are running the OpenSSL version
• Our servers are cloud servers with no domain
• Server and each unique client have secret data that is only known by them

We are not sure how to authenticate the server in this setup using MSQuic:

• The server certificate cannot have a domain, so servers cannot authenticate in that way
• The public key unique key for each client cannot be stored in the secret data as MSQuic has no API to access it before it is sent
• 0-RTT keys are not guaranteed to be used when specified
• The OpenSSL version does not support deferred authentication so authentication cannot be rejected straightaway using custom logic

Do you have any recommendations?

Best,

Richard

[nibanks]

Generally, I believe preshared-keys (https://en.wikipedia.org/wiki/TLS-PSK) is the answer, but I don't know a lot about them. MsQuic doesn't currently expose support for this, but assuming openssl does, it might be pretty easy. Would you be willing to help do some investigation into the level of support that OpenSSL has for this and report back what you find? Then we could give you a better answer as to how hard it would be to integrate into MsQuic.

[nibanks]

I just did a very quick search and found this: https://stackoverflow.com/questions/58719595/how-to-do-tls-1-3-psk-using-openssl. I haven't actually read it deeply though yet.

[mgrichardvanharten]

I am probably the least qualified person to say anything about this as I've never programmed using OpenSSL, but the sample referenced in that StackOverflow thread looks fairly straightforward: https://github.com/TalkWithTLS/TalkWithTLS/tree/master/src/sample

The documentation mentions it is a TLS 1.3 only thing, which MSQuic seems to use by default anyway?

[nibanks]

Yes, QUIC, not just MsQuic, depends solely on TLS 1.3.