TLS 1.3: Opaque PSK silently fails

Summary

Configuring an opaque PSK using mbedtls_ssl_conf_psk_opaque on client side leads to an incorrect PSK Binder generation in the Client Hello message. Looking into the ssl_tls13_psk_get_psk functions reveals that always the ssl->conf->psk pointer is used as PSK, which is NULL for opaque PSK.

On server side, opaque PSKs are not used correctly as well. Here, the PSK is exported in the mbedtls_ssl_tls13_export_handshake_psk function instead of being used as opaque key in the HKDF operation.

System information

Mbed TLS version (number or commit id): 4.1.0 Operating system and version: embedded Configuration (if not default, please attach mbedtls_config.h): Compiler and options (if you used a pre-built binary, please indicate how you obtained it): Additional environment information: gcc

Expected behavior

Opaque PSKs are actually used for binder generation on client side.

Opaque PSKs never need to be exported.

Actual behavior

On client side, a PSK is used which is zero length for binder generation, instead of the configured opaque PSK.

On server side, the PSK is exported for binder generation.

Steps to reproduce

1. Import an opaque PSK as done in ssl_server2.c.
2. Setup a TLS 1.3 connection between server an client.