Ever wondered how to use PSK with the embedded wolfSSL library? PSK is useful in resource constrained devices where public key operations may not be viable. It`s also helpful in closed networks where a Certificate Authority structure isn`t in place. To enable PSK with wolfSSL you can simply do:
$ ./configure --enable-psk
Using PSK on the client side requires one additional function call:
wolfSSL_CTX_set_psk_client_callback()
There`s an example client callback in cyassl/test.h called my_psk_client_cb(). The example sets the client identity which is helpful for the server if there are multiple clients with unique keys and is limited to 128 bytes. It could also examine the server identity hint in case the client is talking to multiple servers with unique keys. Then the pre-shared key is returned to the caller, here that is simply 0x1a2b3c4d, but it could be any key up to 64 bytes in length (512 bits).
On the server side two additional calls are required:
wolfSSL_CTX_set_psk_server_callback()
wolfSSL_CTX_use_psk_identity_hint()
The server stores it`s identity hint to help the client with the 2nd call, in our server example that`s “cyassl server”. An example server psk callback can also be found in my_psk_server_cb() in cyassl/test.h. It verifies the client identity and then returns the key to the caller, which is again 0x1a2b3c4d, but could be any key up to 64 bytes in length. If you have any questions about using PSK with TLS please let us know.