From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 7 Nov 2005 22:31:05 +0000 (+0000)
Subject: more psk stuff
X-Git-Tag: gnutls_1_3_0~50
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=abaed024d8ad97de617ec42b4acad22f25b95b5f;p=thirdparty%2Fgnutls.git

more psk stuff
---

diff --git a/lib/auth_psk.c b/lib/auth_psk.c
index 261d282db2..ff0fed0831 100644
--- a/lib/auth_psk.c
+++ b/lib/auth_psk.c
@@ -29,10 +29,10 @@
 #include "gnutls_errors.h"
 #include "gnutls_auth.h"
 #include "gnutls_auth_int.h"
-#include "psk.h"
 #include "debug.h"
 #include "gnutls_num.h"
-#include "auth_psk.h"
+#include <auth_psk.h>
+#include <auth_psk_passwd.h>
 #include <gnutls_str.h>
 #include <gnutls_datum.h>
 
@@ -40,7 +40,7 @@ int _gnutls_gen_psk_client_kx(gnutls_session_t, opaque **);
 
 int _gnutls_proc_psk_client_kx(gnutls_session_t, opaque *, size_t);
 
-const mod_auth_st srp_auth_struct = {
+const mod_auth_st psk_auth_struct = {
     "PSK",
     NULL,
     NULL,
@@ -57,6 +57,31 @@ const mod_auth_st srp_auth_struct = {
     NULL
 };
 
+/* Set the PSK premaster secret.
+ */
+static int set_psk_session_key( gnutls_session_t session, gnutls_datum* psk)
+{
+    /* set the session key
+     */
+    session->key->key.size = 4 + psk->size + psk->size;
+    session->key->key.data = gnutls_malloc( session->key->key.size);
+    if (session->key->key.data == NULL) {
+        gnutls_assert();
+        return GNUTLS_E_MEMORY_ERROR;
+    }
+
+    /* format of the premaster secret:
+     * (uint16) psk_size
+     * psk_size bytes of zeros
+     * (uint16) psk_size
+     * the psk
+     */
+    _gnutls_write_uint16( psk->size, session->key->key.data);
+    memset( &session->key->key.data[2], 0, psk->size);
+    _gnutls_write_datum16( &session->key->key.data[psk->size + 2], *psk);
+
+    return 0;
+}
 
 
 /* Generates the PSK client key exchange
@@ -72,11 +97,10 @@ const mod_auth_st srp_auth_struct = {
 int _gnutls_gen_psk_client_kx(gnutls_session_t session, opaque ** data)
 {
     int ret;
-    gnutls_datum *username;
     gnutls_psk_client_credentials_t cred;
-    gnutls_datum * psk;
+    gnutls_datum *psk;
     
-    cred = (gnutls_srp_client_credentials_t)
+    cred = (gnutls_psk_client_credentials_t)
 	_gnutls_get_cred(session->key, GNUTLS_CRD_PSK, NULL);
 
     if (cred == NULL) {
@@ -84,34 +108,28 @@ int _gnutls_gen_psk_client_kx(gnutls_session_t session, opaque ** data)
 	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
     }
 
-    if (session->internals.psk_username == NULL) {
-	username = &cred->username;
-	psk = &cred->psk_key;
-    } else {
-	username = &session->internals.psk_username;
-	psk = &session->internals.psk_key;
-    }
+    psk = &cred->key;
 
-    if (username == NULL || psk == NULL) {
+    if (cred->username.data == NULL || psk == NULL) {
 	gnutls_assert();
 	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
     }
 
-    ret = _gnutls_set_datum( session->key.key, psk->data, psk->size);
+    ret = set_psk_session_key( session, psk);
     if (ret < 0) {
-    	gnutls_assert();
-    	return ret;
+        gnutls_assert();
+        return ret;
     }
 
-    (*data) = gnutls_malloc( 2 + username.size);
+    (*data) = gnutls_malloc( 2 + cred->username.size);
     if ((*data) == NULL) {
 	gnutls_assert();
 	return GNUTLS_E_MEMORY_ERROR;
     }
 
-    _gnutls_write_datum16( *data, username);
+    _gnutls_write_datum16( *data, cred->username);
 
-    return (username.size + 2);
+    return (cred->username.size + 2);
 }
 
 
@@ -124,9 +142,10 @@ int _gnutls_proc_psk_client_kx(gnutls_session_t session, opaque * data,
     int ret;
     gnutls_datum username;
     gnutls_psk_client_credentials_t cred;
-    gnutls_datum * psk;
+    gnutls_datum psk;
+    psk_server_auth_info_t info;
 
-    cred = (gnutls_srp_client_credentials_t)
+    cred = (gnutls_psk_client_credentials_t)
 	_gnutls_get_cred(session->key, GNUTLS_CRD_PSK, NULL);
 
     if (cred == NULL) {
@@ -134,6 +153,12 @@ int _gnutls_proc_psk_client_kx(gnutls_session_t session, opaque * data,
 	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
     }
 
+    if ((ret =
+         _gnutls_auth_info_set(session, GNUTLS_CRD_PSK,
+                               sizeof(psk_server_auth_info_st), 1)) < 0) {
+        gnutls_assert();
+        return ret;
+    }
 
     DECR_LEN(data_size, 2);
     username.size = _gnutls_read_uint16(&data[0]);
@@ -141,28 +166,40 @@ int _gnutls_proc_psk_client_kx(gnutls_session_t session, opaque * data,
     DECR_LEN(data_size, username.size);
 
     username.data = &data[2];
-    
-    if (session->internals.psk_passwd_file != NULL) {
-        psk = _gnutls_find_psk( session->internals.psk_passwd_file, &username);
-    } else {
-	psk = _callback_psk( session, &username);
+
+
+    /* copy the username to the auth info structures
+     */
+    info = _gnutls_get_auth_info(session);
+
+    if (username.size > MAX_SRP_USERNAME) {
+        gnutls_assert();
+        return GNUTLS_E_ILLEGAL_SRP_USERNAME;
     }
 
-    if (psk == NULL) {
+    memcpy(info->username, username.data, username.size);
+    info->username[ username.size] = 0;
+
+    /* find the key of this username
+     */
+    ret = _gnutls_psk_pwd_find_entry( session, info->username, &psk);
+    if (ret < 0) {
 	gnutls_assert();
-	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+	return ret;
     }
 
-    /* set the session key
-     */
-    ret = _gnutls_set_datum( session->key.key, psk->data, psk->size);
+    ret = set_psk_session_key( session, &psk);
     if (ret < 0) {
-    	gnutls_assert();
-    	return ret;
+        gnutls_assert();
+        goto error;
     }
 
     return 0;
+
+error:
+    _gnutls_free_datum( &psk);
+    return ret;
 }
 
 
-#endif				/* ENABLE_PSK */
+#endif				/* ENABLE_SRP */
diff --git a/lib/auth_psk_passwd.c b/lib/auth_psk_passwd.c
index 14cfa09f0c..76a2d597d1 100644
--- a/lib/auth_psk_passwd.c
+++ b/lib/auth_psk_passwd.c
@@ -22,7 +22,7 @@
  *
  */
 
-/* Functions for operating in an SRP passwd file are included here */
+/* Functions for operating in an PSK passwd file are included here */
 
 #include <gnutls_int.h>
 
@@ -33,41 +33,32 @@
 #include <auth_psk_passwd.h>
 #include "auth_psk.h"
 #include "gnutls_auth_int.h"
-#include "gnutls_psk.h"
-#include "gnutls_random.h"
 #include "gnutls_dh.h"
 #include "debug.h"
 #include <gnutls_str.h>
 #include <gnutls_datum.h>
 #include <gnutls_num.h>
 
-static int _randomize_pwd_entry(PSK_PWD_ENTRY * entry);
 
-/* this function parses tpasswd.conf file. Format is:
- * string(username):base64(v)
+/* this function parses passwd.psk file. Format is:
+ * string(username):hex(passwd)
  */
-static int pwd_put_values(PSK_PWD_ENTRY * entry, char *str)
+static int pwd_put_values(gnutls_datum* psk, char *str)
 {
     char *p;
     int len, ret;
-    opaque *verifier;
-    size_t verifier_size;
-    int indx;
 
-
-    p = strchr(str, ':');	/* we have index */
+    p = strchr(str, ':');
     if (p == NULL) {
 	gnutls_assert();
-	return GNUTLS_E_PSK_PWD_PARSING_ERROR;
+	return GNUTLS_E_SRP_PWD_PARSING_ERROR;
     }
 
     *p = '\0';
     p++;
 
-    /* username
+    /* skip username
      */
-    len = strlen(p);
-    entry->username = gnutls_strdup( str);
 
     /* read the key
      */
@@ -75,129 +66,61 @@ static int pwd_put_values(PSK_PWD_ENTRY * entry, char *str)
     if (p[len - 1] == '\n' || p[len - 1] == ' ')
 	len--;
 
-    entry->key.size = len;
-    
-    
-    /* now go for key */
-
-
-    return indx;
-}
-
-
-    int ret;
-
-    p = strrchr(str, ':');	/* we have g */
-    if (p == NULL) {
-	gnutls_assert();
-	return GNUTLS_E_SRP_PWD_PARSING_ERROR;
-    }
-
-    *p = '\0';
-    p++;
-
-    /* read the generator */
-    len = strlen(p);
-    if (p[len - 1] == '\n' || p[len - 1] == ' ')
-	len--;
-    ret = _gnutls_sbase64_decode(p, len, &tmp);
-
-    if (ret < 0) {
-	gnutls_assert();
-	return GNUTLS_E_SRP_PWD_PARSING_ERROR;
-    }
-
-    entry->g.data = tmp;
-    entry->g.size = ret;
-
-    /* now go for n - modulo */
-    p = strrchr(str, ':');	/* we have n */
-    if (p == NULL) {
-	_gnutls_free_datum(&entry->g);
-	gnutls_assert();
-	return GNUTLS_E_SRP_PWD_PARSING_ERROR;
+    psk->size = len / 2;
+    psk->data = gnutls_malloc( psk->size);
+    if (psk->data == NULL) {
+        gnutls_assert();
+        return GNUTLS_E_MEMORY_ERROR;
     }
 
-    *p = '\0';
-    p++;
-
-    len = strlen(p);
-    ret = _gnutls_sbase64_decode(p, len, &tmp);
-
-    if (ret < 0) {
-	gnutls_assert();
-	_gnutls_free_datum(&entry->g);
-	return GNUTLS_E_SRP_PWD_PARSING_ERROR;
+    ret = _gnutls_hex2bin( (opaque*)p, len, psk->data, &psk->size);
+    if ( ret < 0) {
+        gnutls_assert();
+        return ret;
     }
 
-    entry->n.data = tmp;
-    entry->n.size = ret;
 
     return 0;
+
 }
 
 
-/* this function opens the tpasswd.conf file and reads the g and n
- * values. They are put in the entry.
+/* Randomizes the given password entry. It actually sets a random password. 
+ * Returns 0 on success.
  */
-static int pwd_read_conf(const char *pconf_file, SRP_PWD_ENTRY * entry,
-			 int idx)
+static int _randomize_psk(gnutls_datum * psk)
 {
-    FILE *fd;
-    char line[2 * 1024];
-    uint i, len;
-    char indexstr[10];
-
-    sprintf(indexstr, "%d", idx);	/* Flawfinder: ignore */
-
-    fd = fopen(pconf_file, "r");
-    if (fd == NULL) {
-	gnutls_assert();
-	return GNUTLS_E_FILE_ERROR;
+    psk->data = gnutls_malloc(16);
+    if (psk->data == NULL) {
+        gnutls_assert();
+        return GNUTLS_E_MEMORY_ERROR;
     }
 
-    len = strlen(indexstr);
-    while (fgets(line, sizeof(line), fd) != NULL) {
-	/* move to first ':' */
-	i = 0;
-	while ((line[i] != ':') && (line[i] != '\0') && (i < sizeof(line))) {
-	    i++;
-	}
-	if (strncmp(indexstr, line, MAX(i, len)) == 0) {
-	    if ((idx = pwd_put_values2(entry, line)) >= 0)
-		return 0;
-	    else {
-		return GNUTLS_E_SRP_PWD_ERROR;
-	    }
-	}
+    psk->size = 16;
+    if (gc_nonce ((char*)psk->data, 16) != GC_OK) {
+        gnutls_assert();
+        return GNUTLS_E_RANDOM_FAILED;
     }
-    return GNUTLS_E_SRP_PWD_ERROR;
 
+    return 0;
 }
 
-int _gnutls_srp_pwd_read_entry(gnutls_session_t state, char *username,
-			       SRP_PWD_ENTRY ** _entry)
+/* Returns the PSK key of the given user. 
+ * If the user doesn't exist a random password is returned instead.
+ */
+int _gnutls_psk_pwd_find_entry(gnutls_session_t session, char *username,
+       gnutls_datum* psk)
 {
-    gnutls_srp_server_credentials_t cred;
+    gnutls_psk_server_credentials_t cred;
     FILE *fd;
     char line[2 * 1024];
     uint i, len;
     int ret;
-    int idx, last_idx;
-    SRP_PWD_ENTRY *entry;
-
-    *_entry = gnutls_calloc(1, sizeof(SRP_PWD_ENTRY));
-    if (*_entry == NULL) {
-	gnutls_assert();
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-    entry = *_entry;
 
-    cred = (gnutls_srp_server_credentials_t)
-        _gnutls_get_cred(state->key, GNUTLS_CRD_SRP, NULL);
+    cred = (gnutls_psk_server_credentials_t)
+        _gnutls_get_cred(session->key, GNUTLS_CRD_PSK, NULL);
     if (cred == NULL) {
 	gnutls_assert();
-	_gnutls_srp_entry_free(entry);
 	return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
     }
 
@@ -205,26 +128,19 @@ int _gnutls_srp_pwd_read_entry(gnutls_session_t state, char *username,
      * set, use it.
      */
     if (cred->pwd_callback != NULL) {
-	ret = cred->pwd_callback(state, username, &entry->salt,
-				 &entry->v, &entry->g, &entry->n);
+	ret = cred->pwd_callback(session, username, psk);
 
 	if (ret == 1) {		/* the user does not exist */
-	    if (entry->g.size != 0 && entry->n.size != 0) {
-		ret = _randomize_pwd_entry(entry);
+               	ret = _randomize_psk(psk);
 		if (ret < 0) {
-		    _gnutls_srp_entry_free(entry);
+		    gnutls_assert();
 		    return ret;
 		}
 		return 0;
-	    } else {
-		gnutls_assert();
-		ret = -1;	/* error in the callback */
-	    }
 	}
 
 	if (ret < 0) {
 	    gnutls_assert();
-	    _gnutls_srp_entry_free(entry);
 	    return GNUTLS_E_SRP_PWD_ERROR;
 	}
 
@@ -233,7 +149,6 @@ int _gnutls_srp_pwd_read_entry(gnutls_session_t state, char *username,
 
     /* The callback was not set. Proceed.
      */
-
     if (cred->password_file == NULL) {
 	gnutls_assert();
 	return GNUTLS_E_SRP_PWD_ERROR;
@@ -244,12 +159,9 @@ int _gnutls_srp_pwd_read_entry(gnutls_session_t state, char *username,
     fd = fopen(cred->password_file, "r");
     if (fd == NULL) {
 	gnutls_assert();
-	_gnutls_srp_entry_free(entry);
 	return GNUTLS_E_SRP_PWD_ERROR;
     }
 
-    last_idx = 1;		/* a default value */
-
     len = strlen(username);
     while (fgets(line, sizeof(line), fd) != NULL) {
 	/* move to first ':' */
@@ -259,105 +171,27 @@ int _gnutls_srp_pwd_read_entry(gnutls_session_t state, char *username,
 	}
 
 	if (strncmp(username, line, MAX(i, len)) == 0) {
-	    if ((idx = pwd_put_values(entry, line)) >= 0) {
-		/* Keep the last index in memory, so we can retrieve fake parameters (g,n)
-		 * when the user does not exist.
-		 */
-		last_idx = idx;
-		if (pwd_read_conf(cred->password_conf_file, entry, idx)
-		    == 0) {
-		    return 0;
-		} else {
-		    gnutls_assert();
-		    _gnutls_srp_entry_free(entry);
+	    ret = pwd_put_values(psk, line);
+            if (ret < 0) {
+        	    gnutls_assert();
 		    return GNUTLS_E_SRP_PWD_ERROR;
-		}
-	    } else {
-		gnutls_assert();
-		_gnutls_srp_entry_free(entry);
-		return GNUTLS_E_SRP_PWD_ERROR;
-	    }
+            }
+            return 0;
 	}
     }
 
-    /* user was not found. Fake him. Actually read the g,n values from
+    /* user was not found. Fake him. 
      * the last index found and randomize the entry.
      */
-    if (pwd_read_conf(cred->password_conf_file, entry, last_idx) == 0) {
-	ret = _randomize_pwd_entry(entry);
-	if (ret < 0) {
-	    gnutls_assert();
-	    _gnutls_srp_entry_free(entry);
-	    return ret;
-	}
-
-	return 0;
-    }
-
-    gnutls_assert();
-    _gnutls_srp_entry_free(entry);
-    return GNUTLS_E_SRP_PWD_ERROR;
-
-}
-
-/* Randomizes the given password entry. It actually sets the verifier
- * and the salt. Returns 0 on success.
- */
-static int _randomize_pwd_entry(SRP_PWD_ENTRY * entry)
-{
-    unsigned char rnd;
-
-    if (entry->g.size == 0 || entry->n.size == 0) {
-	gnutls_assert();
-	return GNUTLS_E_INTERNAL_ERROR;
-    }
-
-    _gnutls_get_random(&rnd, 1, GNUTLS_WEAK_RANDOM);
-    entry->salt.size = (rnd % 10) + 9;
-
-    entry->v.data = gnutls_malloc(20);
-    entry->v.size = 20;
-    if (entry->v.data == NULL) {
-	gnutls_assert();
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-
-    _gnutls_get_random(entry->v.data, 20, GNUTLS_WEAK_RANDOM);
-
-    entry->salt.data = gnutls_malloc(entry->salt.size);
-    if (entry->salt.data == NULL) {
-	gnutls_assert();
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-
-    if (_gnutls_get_random
-	(entry->salt.data, entry->salt.size, GNUTLS_WEAK_RANDOM) < 0) {
+    ret = _randomize_psk(psk);
+    if (ret < 0) {
 	gnutls_assert();
-	return GNUTLS_E_MEMORY_ERROR;
+	return ret;
     }
 
     return 0;
-}
-
-/* Free all the entry parameters, except if g and n are
- * the static ones defined in extra.h
- */
-void _gnutls_srp_entry_free(SRP_PWD_ENTRY * entry)
-{
-    _gnutls_free_datum(&entry->v);
-    _gnutls_free_datum(&entry->salt);
-
-    if (entry->g.data != gnutls_srp_1024_group_generator.data)
-	_gnutls_free_datum(&entry->g);
-
-    if (entry->n.data != gnutls_srp_1024_group_prime.data &&
-	entry->n.data != gnutls_srp_1536_group_prime.data &&
-	entry->n.data != gnutls_srp_2048_group_prime.data)
-	_gnutls_free_datum(&entry->n);
 
-    gnutls_free(entry->username);
-    gnutls_free(entry);
 }
 
 
-#endif				/* ENABLE SRP */
+#endif				/* ENABLE PSK */
diff --git a/lib/auth_psk_passwd.h b/lib/auth_psk_passwd.h
index 7cdfddd7b0..41d54bc5fa 100644
--- a/lib/auth_psk_passwd.h
+++ b/lib/auth_psk_passwd.h
@@ -24,14 +24,8 @@
 
 #ifdef ENABLE_PSK
 
-typedef struct {
-    char *username;
-    gnutls_datum_t key;
-} PSK_PWD_ENTRY;
-
 /* this is locally allocated. It should be freed using the provided function */
-int _gnutls_psk_pwd_read_entry(gnutls_session_t state, char *username,
-			       PSK_PWD_ENTRY **);
-void _gnutls_psk_entry_free(SRP_PSK_ENTRY * entry);
+int _gnutls_psk_pwd_find_entry(gnutls_session_t, char *username,
+			       gnutls_datum* key);
 
 #endif				/* ENABLE_SRP */
diff --git a/lib/gnutls_psk.c b/lib/gnutls_psk.c
index 629c860016..a15c50314e 100644
--- a/lib/gnutls_psk.c
+++ b/lib/gnutls_psk.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ * Copyright (C) 2005 Free Software Foundation
  *
  * Author: Nikos Mavroyanopoulos
  *
@@ -22,385 +22,49 @@
  *
  */
 
+/* Functions for manipulating the PSK credentials. */
+
 #include <gnutls_int.h>
 #include <gnutls_errors.h>
-#include <auth_srp.h>
+#include <auth_psk.h>
 #include <gnutls_state.h>
 
-#ifdef ENABLE_SRP
+#ifdef ENABLE_PSK
 
-#include <gnutls_srp.h>
-#include <auth_srp_passwd.h>
-#include <gnutls_mpi.h>
+//#include <gnutls_.h>
+#include <auth_psk_passwd.h>
 #include <gnutls_num.h>
+#include <gnutls_helper.h>
+#include <gnutls_datum.h>
 #include "debug.h"
 
-
-/* Here functions for SRP (like g^x mod n) are defined 
- */
-
-int _gnutls_srp_gx(opaque * text, size_t textsize, opaque ** result,
-		   mpi_t g, mpi_t prime, gnutls_alloc_function galloc_func)
-{
-    mpi_t x, e;
-    size_t result_size;
-
-    if (_gnutls_mpi_scan_nz(&x, text, &textsize)) {
-	gnutls_assert();
-	return GNUTLS_E_MPI_SCAN_FAILED;
-    }
-
-    e = _gnutls_mpi_alloc_like(prime);
-    if (e == NULL) {
-	gnutls_assert();
-	_gnutls_mpi_release(&x);
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-
-    /* e = g^x mod prime (n) */
-    _gnutls_mpi_powm(e, g, x, prime);
-    _gnutls_mpi_release(&x);
-
-    _gnutls_mpi_print(NULL, &result_size, e);
-    if (result != NULL) {
-	*result = galloc_func(result_size);
-	if ((*result) == NULL)
-	    return GNUTLS_E_MEMORY_ERROR;
-
-	_gnutls_mpi_print(*result, &result_size, e);
-    }
-
-    _gnutls_mpi_release(&e);
-
-    return result_size;
-
-}
-
-
-/****************
- * Choose a random value b and calculate B = (k* v + g^b) % N.
- * where k == SHA1(N|g)
- * Return: B and if ret_b is not NULL b.
- */
-mpi_t _gnutls_calc_srp_B(mpi_t * ret_b, mpi_t g, mpi_t n, mpi_t v)
-{
-    mpi_t tmpB = NULL, tmpV = NULL;
-    mpi_t b = NULL, B = NULL, k = NULL;
-    int bits;
-
-
-    /* calculate:  B = (k*v + g^b) % N 
-     */
-    bits = _gnutls_mpi_get_nbits(n);
-    b = _gnutls_mpi_snew(bits);
-    if (b == NULL) {
-	gnutls_assert();
-	return NULL;
-    }
-
-    tmpV = _gnutls_mpi_alloc_like(n);
-
-    if (tmpV == NULL) {
-	gnutls_assert();
-	goto error;
-    }
-
-    _gnutls_mpi_randomize(b, bits, GCRY_STRONG_RANDOM);
-
-    tmpB = _gnutls_mpi_snew(bits);
-    if (tmpB == NULL) {
-	gnutls_assert();
-	goto error;
-    }
-
-    B = _gnutls_mpi_snew(bits);
-    if (B == NULL) {
-	gnutls_assert();
-	goto error;
-    }
-
-    k = _gnutls_calc_srp_u(n, g, n);
-    if (k == NULL) {
-	gnutls_assert();
-	goto error;
-    }
-
-    _gnutls_mpi_mulm(tmpV, k, v, n);
-    _gnutls_mpi_powm(tmpB, g, b, n);
-
-    _gnutls_mpi_addm(B, tmpV, tmpB, n);
-
-    _gnutls_mpi_release(&k);
-    _gnutls_mpi_release(&tmpB);
-    _gnutls_mpi_release(&tmpV);
-
-    if (ret_b)
-	*ret_b = b;
-    else
-	_gnutls_mpi_release(&b);
-
-    return B;
-
-  error:
-    _gnutls_mpi_release(&b);
-    _gnutls_mpi_release(&B);
-    _gnutls_mpi_release(&k);
-    _gnutls_mpi_release(&tmpB);
-    _gnutls_mpi_release(&tmpV);
-    return NULL;
-
-}
-
-/* This calculates the SHA1(A | B)
- * A and B will be left-padded with zeros to fill n_size.
- */
-mpi_t _gnutls_calc_srp_u(mpi_t A, mpi_t B, mpi_t n)
-{
-    size_t b_size, a_size;
-    opaque *holder, hd[MAX_HASH_SIZE];
-    size_t holder_size, hash_size, n_size;
-    GNUTLS_HASH_HANDLE td;
-    int ret;
-    mpi_t res;
-
-    /* get the size of n in bytes */
-    _gnutls_mpi_print(NULL, &n_size, n);
-
-    _gnutls_mpi_print(NULL, &a_size, A);
-    _gnutls_mpi_print(NULL, &b_size, B);
-
-    if (a_size > n_size || b_size > n_size) {
-	gnutls_assert();
-	return NULL;		/* internal error */
-    }
-
-    holder_size = n_size + n_size;
-
-    holder = gnutls_calloc(1, holder_size);
-    if (holder == NULL)
-	return NULL;
-
-    _gnutls_mpi_print(&holder[n_size - a_size], &a_size, A);
-    _gnutls_mpi_print(&holder[n_size + n_size - b_size], &b_size, B);
-
-    td = _gnutls_hash_init(GNUTLS_MAC_SHA1);
-    if (td == NULL) {
-	gnutls_free(holder);
-	gnutls_assert();
-	return NULL;
-    }
-    _gnutls_hash(td, holder, holder_size);
-    _gnutls_hash_deinit(td, hd);
-
-    /* convert the bytes of hd to integer
-     */
-    hash_size = 20;		/* SHA */
-    ret = _gnutls_mpi_scan_nz(&res, hd, &hash_size);
-    gnutls_free(holder);
-
-    if (ret < 0) {
-	gnutls_assert();
-	return NULL;
-    }
-
-    return res;
-}
-
-/* S = (A * v^u) ^ b % N 
- * this is our shared key (server premaster secret)
- */
-mpi_t _gnutls_calc_srp_S1(mpi_t A, mpi_t b, mpi_t u, mpi_t v, mpi_t n)
-{
-    mpi_t tmp1 = NULL, tmp2 = NULL;
-    mpi_t S = NULL;
-
-    S = _gnutls_mpi_alloc_like(n);
-    if (S == NULL)
-	return NULL;
-
-    tmp1 = _gnutls_mpi_alloc_like(n);
-    tmp2 = _gnutls_mpi_alloc_like(n);
-
-    if (tmp1 == NULL || tmp2 == NULL)
-	goto freeall;
-
-    _gnutls_mpi_powm(tmp1, v, u, n);
-    _gnutls_mpi_mulm(tmp2, A, tmp1, n);
-    _gnutls_mpi_powm(S, tmp2, b, n);
-
-    _gnutls_mpi_release(&tmp1);
-    _gnutls_mpi_release(&tmp2);
-
-    return S;
-
-  freeall:
-    _gnutls_mpi_release(&tmp1);
-    _gnutls_mpi_release(&tmp2);
-    return NULL;
-}
-
-/* A = g^a % N 
- * returns A and a (which is random)
- */
-mpi_t _gnutls_calc_srp_A(mpi_t * a, mpi_t g, mpi_t n)
-{
-    mpi_t tmpa;
-    mpi_t A;
-    int bits;
-
-    bits = _gnutls_mpi_get_nbits(n);
-    tmpa = _gnutls_mpi_snew(bits);
-    if (tmpa == NULL) {
-	gnutls_assert();
-	return NULL;
-    }
-
-    _gnutls_mpi_randomize(tmpa, bits, GCRY_STRONG_RANDOM);
-
-    A = _gnutls_mpi_snew(bits);
-    if (A == NULL) {
-	gnutls_assert();
-	_gnutls_mpi_release(&tmpa);
-	return NULL;
-    }
-    _gnutls_mpi_powm(A, g, tmpa, n);
-
-    if (a != NULL)
-	*a = tmpa;
-    else
-	_gnutls_mpi_release(&tmpa);
-
-    return A;
-}
-
-/* generate x = SHA(s | SHA(U | ":" | p))
- * The output is exactly 20 bytes
- */
-int _gnutls_calc_srp_sha(const char *username, const char *password,
-			 opaque * salt, int salt_size, size_t * size,
-			 void *digest)
-{
-    GNUTLS_HASH_HANDLE td;
-    opaque res[MAX_HASH_SIZE];
-
-    *size = 20;
-
-    td = _gnutls_hash_init(GNUTLS_MAC_SHA1);
-    if (td == NULL) {
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-    _gnutls_hash(td, username, strlen(username));
-    _gnutls_hash(td, ":", 1);
-    _gnutls_hash(td, password, strlen(password));
-
-    _gnutls_hash_deinit(td, res);
-
-    td = _gnutls_hash_init(GNUTLS_MAC_SHA1);
-    if (td == NULL) {
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-
-    _gnutls_hash(td, salt, salt_size);
-    _gnutls_hash(td, res, 20);	/* 20 bytes is the output of sha1 */
-
-    _gnutls_hash_deinit(td, digest);
-
-    return 0;
-}
-
-int _gnutls_calc_srp_x(char *username, char *password, opaque * salt,
-		       size_t salt_size, size_t * size, void *digest)
-{
-
-    return _gnutls_calc_srp_sha(username, password, salt,
-				salt_size, size, digest);
-}
-
-
-/* S = (B - k*g^x) ^ (a + u * x) % N
- * this is our shared key (client premaster secret)
- */
-mpi_t _gnutls_calc_srp_S2(mpi_t B, mpi_t g, mpi_t x,
-			  mpi_t a, mpi_t u, mpi_t n)
-{
-    mpi_t S = NULL, tmp1 = NULL, tmp2 = NULL;
-    mpi_t tmp4 = NULL, tmp3 = NULL, k = NULL;
-
-    S = _gnutls_mpi_alloc_like(n);
-    if (S == NULL)
-	return NULL;
-
-    tmp1 = _gnutls_mpi_alloc_like(n);
-    tmp2 = _gnutls_mpi_alloc_like(n);
-    tmp3 = _gnutls_mpi_alloc_like(n);
-    if (tmp1 == NULL || tmp2 == NULL || tmp3 == NULL) {
-	goto freeall;
-    }
-
-    k = _gnutls_calc_srp_u(n, g, n);
-    if (k == NULL) {
-	gnutls_assert();
-	goto freeall;
-    }
-
-    _gnutls_mpi_powm(tmp1, g, x, n);	/* g^x */
-    _gnutls_mpi_mulm(tmp3, tmp1, k, n);	/* k*g^x mod n */
-    _gnutls_mpi_subm(tmp2, B, tmp3, n);
-
-    tmp4 = _gnutls_mpi_alloc_like(n);
-    if (tmp4 == NULL)
-	goto freeall;
-
-    _gnutls_mpi_mul(tmp1, u, x);
-    _gnutls_mpi_add(tmp4, a, tmp1);
-    _gnutls_mpi_powm(S, tmp2, tmp4, n);
-
-    _gnutls_mpi_release(&tmp1);
-    _gnutls_mpi_release(&tmp2);
-    _gnutls_mpi_release(&tmp3);
-    _gnutls_mpi_release(&tmp4);
-    _gnutls_mpi_release(&k);
-
-    return S;
-
-  freeall:
-    _gnutls_mpi_release(&k);
-    _gnutls_mpi_release(&tmp1);
-    _gnutls_mpi_release(&tmp2);
-    _gnutls_mpi_release(&tmp3);
-    _gnutls_mpi_release(&tmp4);
-    _gnutls_mpi_release(&S);
-    return NULL;
-}
-
 /**
-  * gnutls_srp_free_client_credentials - Used to free an allocated gnutls_srp_client_credentials_t structure
-  * @sc: is an #gnutls_srp_client_credentials_t structure.
+  * gnutls_psk_free_client_credentials - Used to free an allocated gnutls_psk_client_credentials_t structure
+  * @sc: is an #gnutls_psk_client_credentials_t structure.
   *
   * This structure is complex enough to manipulate directly thus
   * this helper function is provided in order to free (deallocate) it.
   *
   **/
-void gnutls_srp_free_client_credentials(gnutls_srp_client_credentials_t sc)
+void gnutls_psk_free_client_credentials(gnutls_psk_client_credentials_t sc)
 {
-    gnutls_free(sc->username);
-    gnutls_free(sc->password);
+    _gnutls_free_datum(&sc->username);
+    _gnutls_free_datum(&sc->key);
     gnutls_free(sc);
 }
 
 /**
-  * gnutls_srp_allocate_client_credentials - Used to allocate an gnutls_srp_server_credentials_t structure
-  * @sc: is a pointer to an #gnutls_srp_server_credentials_t structure.
+  * gnutls_psk_allocate_client_credentials - Used to allocate an gnutls_psk_server_credentials_t structure
+  * @sc: is a pointer to an #gnutls_psk_server_credentials_t structure.
   *
   * This structure is complex enough to manipulate directly thus
   * this helper function is provided in order to allocate it.
   *
   * Returns 0 on success.
   **/
-int gnutls_srp_allocate_client_credentials(gnutls_srp_client_credentials_t
-					   * sc)
+int gnutls_psk_allocate_client_credentials(gnutls_psk_client_credentials_t* sc)
 {
-    *sc = gnutls_calloc(1, sizeof(srp_client_credentials_st));
+    *sc = gnutls_calloc(1, sizeof(psk_client_credentials_st));
 
     if (*sc == NULL)
 	return GNUTLS_E_MEMORY_ERROR;
@@ -409,68 +73,89 @@ int gnutls_srp_allocate_client_credentials(gnutls_srp_client_credentials_t
 }
 
 /**
-  * gnutls_srp_set_client_credentials - Used to set the username/password, in a gnutls_srp_client_credentials_t structure
-  * @res: is an #gnutls_srp_client_credentials_t structure.
+  * gnutls_psk_set_client_credentials - Used to set the username/password, in a gnutls_psk_client_credentials_t structure
+  * @res: is an #gnutls_psk_client_credentials_t structure.
   * @username: is the user's userid
-  * @password: is the user's password
+  * @key: is the user's key
   *
-  * This function sets the username and password, in a gnutls_srp_client_credentials_t structure.
+  * This function sets the username and password, in a gnutls_psk_client_credentials_t structure.
   * Those will be used in SRP authentication. @username and @password should be ASCII
   * strings or UTF-8 strings prepared using the "SASLprep" profile of "stringprep".
   *
   * Returns 0 on success.
   **/
-int gnutls_srp_set_client_credentials(gnutls_srp_client_credentials_t res,
-				      char *username, char *password)
+int gnutls_psk_set_client_credentials(gnutls_psk_client_credentials_t res,
+				      const char *username, const gnutls_datum *key,
+                                      unsigned int flags)
 {
+int ret;
 
-    if (username == NULL || password == NULL) {
+    if (username == NULL || key == NULL) {
 	gnutls_assert();
 	return GNUTLS_E_INVALID_REQUEST;
     }
 
-    res->username = gnutls_strdup(username);
-    if (res->username == NULL)
-	return GNUTLS_E_MEMORY_ERROR;
+    ret = _gnutls_set_datum(&res->username, username, strlen(username));
+    if (ret < 0) 
+	return ret;
+
+    if (flags == GNUTLS_PSK_KEY_RAW) {
+            if (_gnutls_set_datum( &res->key, key->data, key->size) < 0) {
+                gnutls_assert();
+                ret = GNUTLS_E_MEMORY_ERROR;
+                goto error;
+            }
+    } else { /* HEX key */
+            res->key.size = key->size / 2;
+            res->key.data = gnutls_malloc( res->key.size);
+            if (res->key.data == NULL) {
+                gnutls_assert();
+                ret = GNUTLS_E_MEMORY_ERROR;
+                goto error;
+            }
+
+            ret = gnutls_hex_decode( key, (char*)res->key.data, &res->key.size);
+            if (ret < 0) {
+                gnutls_assert();
+                goto error;
+            }
 
-    res->password = gnutls_strdup(password);
-    if (res->password == NULL) {
-	gnutls_free(res->username);
-	return GNUTLS_E_MEMORY_ERROR;
     }
 
     return 0;
+
+error:
+        _gnutls_free_datum( &res->username);
+
+        return ret;
 }
 
 /**
-  * gnutls_srp_free_server_credentials - Used to free an allocated gnutls_srp_server_credentials_t structure
-  * @sc: is an #gnutls_srp_server_credentials_t structure.
+  * gnutls_psk_free_server_credentials - Used to free an allocated gnutls_psk_server_credentials_t structure
+  * @sc: is an #gnutls_psk_server_credentials_t structure.
   *
   * This structure is complex enough to manipulate directly thus
   * this helper function is provided in order to free (deallocate) it.
   *
   **/
-void gnutls_srp_free_server_credentials(gnutls_srp_server_credentials_t sc)
+void gnutls_psk_free_server_credentials(gnutls_psk_server_credentials_t sc)
 {
     gnutls_free(sc->password_file);
-    gnutls_free(sc->password_conf_file);
-
     gnutls_free(sc);
 }
 
 /**
-  * gnutls_srp_allocate_server_credentials - Used to allocate an gnutls_srp_server_credentials_t structure
-  * @sc: is a pointer to an #gnutls_srp_server_credentials_t structure.
+  * gnutls_psk_allocate_server_credentials - Used to allocate an gnutls_psk_server_credentials_t structure
+  * @sc: is a pointer to an #gnutls_psk_server_credentials_t structure.
   *
   * This structure is complex enough to manipulate directly thus
   * this helper function is provided in order to allocate it.
   * 
   * Returns 0 on success.
   **/
-int gnutls_srp_allocate_server_credentials(gnutls_srp_server_credentials_t
-					   * sc)
+int gnutls_psk_allocate_server_credentials(gnutls_psk_server_credentials_t* sc)
 {
-    *sc = gnutls_calloc(1, sizeof(srp_server_cred_st));
+    *sc = gnutls_calloc(1, sizeof(psk_server_cred_st));
 
     if (*sc == NULL)
 	return GNUTLS_E_MEMORY_ERROR;
@@ -478,47 +163,29 @@ int gnutls_srp_allocate_server_credentials(gnutls_srp_server_credentials_t
     return 0;
 }
 
-inline static int file_exists(const char *file)
-{
-    FILE *fd;
-
-    fd = fopen(file, "r");
-    if (fd == NULL)
-	return -1;
-
-    fclose(fd);
-    return 0;
-}
 
 /**
-  * gnutls_srp_set_server_credentials_file - Used to set the password files, in a gnutls_srp_server_credentials_t structure
-  * @res: is an #gnutls_srp_server_credentials_t structure.
-  * @password_file: is the SRP password file (tpasswd)
-  * @password_conf_file: is the SRP password conf file (tpasswd.conf)
+  * gnutls_psk_set_server_credentials_file - Used to set the password files, in a gnutls_psk_server_credentials_t structure
+  * @res: is an #gnutls_psk_server_credentials_t structure.
+  * @password_file: is the PSK password file (passwd.psk)
   *
-  * This function sets the password files, in a gnutls_srp_server_credentials_t structure.
-  * Those password files hold usernames and verifiers and will be used for SRP authentication.
+  * This function sets the password file, in a gnutls_psk_server_credentials_t structure.
+  * This password file holds usernames and keys and will be used for PSK authentication.
   *
   * Returns 0 on success.
   *
   **/
-int gnutls_srp_set_server_credentials_file(gnutls_srp_server_credentials_t
-					   res, const char *password_file,
-					   const char *password_conf_file)
+int gnutls_psk_set_server_credentials_file(gnutls_psk_server_credentials_t
+					   res, const char *password_file)
 {
 
-    if (password_file == NULL || password_conf_file == NULL) {
+    if (password_file == NULL) {
 	gnutls_assert();
 	return GNUTLS_E_INVALID_REQUEST;
     }
 
     /* Check if the files can be opened */
-    if (file_exists(password_file) != 0) {
-	gnutls_assert();
-	return GNUTLS_E_FILE_ERROR;
-    }
-
-    if (file_exists(password_conf_file) != 0) {
+    if (_gnutls_file_exists(password_file) != 0) {
 	gnutls_assert();
 	return GNUTLS_E_FILE_ERROR;
     }
@@ -529,91 +196,65 @@ int gnutls_srp_set_server_credentials_file(gnutls_srp_server_credentials_t
 	return GNUTLS_E_MEMORY_ERROR;
     }
 
-    res->password_conf_file = gnutls_strdup(password_conf_file);
-    if (res->password_conf_file == NULL) {
-	gnutls_assert();
-	gnutls_free(res->password_file);
-	res->password_file = NULL;
-	return GNUTLS_E_MEMORY_ERROR;
-    }
-
     return 0;
 }
 
 
 /**
-  * gnutls_srp_set_server_credentials_function - Used to set a callback to retrieve the user's SRP credentials
-  * @cred: is a #gnutls_srp_server_credentials_t structure.
+  * gnutls_psk_set_server_credentials_function - Used to set a callback to retrieve the user's PSK credentials
+  * @cred: is a #gnutls_psk_server_credentials_t structure.
   * @func: is the callback function
   *
-  * This function can be used to set a callback to retrieve the user's SRP credentials.
+  * This function can be used to set a callback to retrieve the user's PSK credentials.
   * The callback's function form is:
   * int (*callback)(gnutls_session_t, const char* username,
-  *  gnutls_datum_t* salt, gnutls_datum_t *verifier, gnutls_datum_t* g,
-  *  gnutls_datum_t* n);
+  *  gnutls_datum_t* key);
   *
   * @username contains the actual username. 
-  * The @salt, @verifier, @generator and @prime must be filled
-  * in using the gnutls_malloc(). For convenience @prime and @generator 
-  * may also be one of the static parameters defined in extra.h.
+  * The @key must be filled in using the gnutls_malloc(). 
   *
   * In case the callback returned a negative number then gnutls will
   * assume that the username does not exist.
   *
-  * In order to prevent attackers from guessing valid usernames,
-  * if a user does not exist, g and n values should be filled in
-  * using a random user's parameters. In that case the callback must
-  * return the special value (1).
-  *
   * The callback function will only be called once per handshake.
   * The callback function should return 0 on success, while
   * -1 indicates an error.
   *
   **/
 void
-gnutls_srp_set_server_credentials_function(gnutls_srp_server_credentials_t
+gnutls_psk_set_server_credentials_function(gnutls_psk_server_credentials_t
 					   cred,
-					   gnutls_srp_server_credentials_function
+					   gnutls_psk_server_credentials_function
 					   * func)
 {
     cred->pwd_callback = func;
 }
 
 /**
-  * gnutls_srp_set_client_credentials_function - Used to set a callback to retrieve the username and password
-  * @cred: is a #gnutls_srp_server_credentials_t structure.
+  * gnutls_psk_set_client_credentials_function - Used to set a callback to retrieve the username and key
+  * @cred: is a #gnutls_psk_server_credentials_t structure.
   * @func: is the callback function
   *
   * This function can be used to set a callback to retrieve the username and
-  * password for client SRP authentication.
+  * password for client PSK authentication.
   * The callback's function form is:
-  * int (*callback)(gnutls_session_t, unsigned int times, char** username,
-  *  char** password);
+  * int (*callback)(gnutls_session_t, char** username,
+  *  gnutls_datum* key);
   *
-  * The @username and @password must be allocated using gnutls_malloc().
-  * @times will be 0 the first time called, and 1 the second.
-  * @username and @password should be ASCII strings or UTF-8 strings 
+  * The @username and @key must be allocated using gnutls_malloc().
+  * @username should be ASCII strings or UTF-8 strings 
   * prepared using the "SASLprep" profile of "stringprep".
   *
-  * The callback function will be called once or twice per handshake.
-  * The first time called, is before the ciphersuite is negotiated.
-  * At that time if the callback returns a negative error code,
-  * the callback will be called again if SRP has been
-  * negotiated. This uses a special TLS-SRP idiom in order to avoid
-  * asking the user for SRP password and username if the server does
-  * not support SRP.
+  * The callback function will be called once per handshake.
   * 
-  * The callback should not return a negative error code the second
-  * time called, since the handshake procedure will be aborted.
-  *
   * The callback function should return 0 on success.
   * -1 indicates an error.
   *
   **/
 void
-gnutls_srp_set_client_credentials_function(gnutls_srp_client_credentials_t
+gnutls_psk_set_client_credentials_function(gnutls_psk_client_credentials_t
 					   cred,
-					   gnutls_srp_client_credentials_function
+					   gnutls_psk_client_credentials_function
 					   * func)
 {
     cred->get_function = func;
@@ -621,19 +262,19 @@ gnutls_srp_set_client_credentials_function(gnutls_srp_client_credentials_t
 
 
 /**
-  * gnutls_srp_server_get_username - This function returns the username of the peer
+  * gnutls_psk_server_get_username - This function returns the username of the peer
   * @session: is a gnutls session
   *
   * This function will return the username of the peer. This should only be
-  * called in case of SRP authentication and in case of a server.
+  * called in case of PSK authentication and in case of a server.
   * Returns NULL in case of an error.
   *
   **/
-const char *gnutls_srp_server_get_username(gnutls_session_t session)
+const char *gnutls_psk_server_get_username(gnutls_session_t session)
 {
-    srp_server_auth_info_t info;
+    psk_server_auth_info_t info;
 
-    CHECK_AUTH(GNUTLS_CRD_SRP, NULL);
+    CHECK_AUTH(GNUTLS_CRD_PSK, NULL);
 
     info = _gnutls_get_auth_info(session);
     if (info == NULL)
@@ -642,59 +283,55 @@ const char *gnutls_srp_server_get_username(gnutls_session_t session)
 }
 
 /**
-  * gnutls_srp_verifier - Used to calculate an SRP verifier
-  * @username: is the user's name
-  * @password: is the user's password
-  * @salt: should be some randomly generated bytes
-  * @generator: is the generator of the group
-  * @prime: is the group's prime
-  * @res: where the verifier will be stored.
+  * gnutls_hex_decode - This function will decode hex encoded data
+  * @hex_data: contain the encoded data
+  * @result: the place where decoded data will be copied
+  * @result_size: holds the size of the result
   *
-  * This function will create an SRP verifier, as specified in RFC2945.
-  * The @prime and @generator should be one of the static parameters defined
-  * in gnutls/extra.h or may be generated using the GCRYPT functions
-  * gcry_prime_generate() and gcry_prime_group_generator().
-  * The verifier will be allocated with @malloc and will be stored in @res using 
-  * binary format.
+  * This function will decode the given encoded data, using the hex encoding
+  * used by PSK password files.
   *
+  * Note that hex_data should be null terminated.
+  * 
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the buffer given is not long enough,
+  * or 0 on success.
   **/
-int gnutls_srp_verifier(const char *username, const char *password,
-			const gnutls_datum_t * salt,
-			const gnutls_datum_t * generator,
-			const gnutls_datum_t * prime, gnutls_datum_t * res)
+int gnutls_hex_decode(const gnutls_datum_t * hex_data, char *result,
+                             size_t *result_size)
 {
-    mpi_t _n, _g;
     int ret;
-    size_t digest_size = 20, size;
-    opaque digest[20];
 
-    ret = _gnutls_calc_srp_sha(username, password, salt->data,
-			       salt->size, &digest_size, digest);
-    if (ret < 0) {
-	gnutls_assert();
-	return ret;
-    }
+    ret = _gnutls_hex2bin(hex_data->data, hex_data->size, (opaque*)result, result_size);
+    if (ret < 0)
+        return ret;
 
-    size = prime->size;
-    if (_gnutls_mpi_scan_nz(&_n, prime->data, &size)) {
-	gnutls_assert();
-	return GNUTLS_E_MPI_SCAN_FAILED;
-    }
+    return 0;
+}
 
-    size = generator->size;
-    if (_gnutls_mpi_scan_nz(&_g, generator->data, &size)) {
-	gnutls_assert();
-	return GNUTLS_E_MPI_SCAN_FAILED;
+/**
+  * gnutls_hex_encode - This function will convert raw data to hex encoded
+  * @data: contain the raw data
+  * @result: the place where hex data will be copied
+  * @result_size: holds the size of the result
+  *
+  * This function will convert the given data to printable data, using the hex 
+  * encoding, as used in the PSK password files.
+  * 
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the buffer given is not long enough,
+  * or 0 on success.
+  **/
+int gnutls_hex_encode(const gnutls_datum_t * data, char *result,
+                             size_t *result_size)
+{
+    if (*result_size < data->size + data->size + 1) {
+         gnutls_assert();
+         return GNUTLS_E_SHORT_MEMORY_BUFFER;
     }
 
-    ret = _gnutls_srp_gx(digest, 20, &res->data, _g, _n, malloc);
-    if (ret < 0) {
-	gnutls_assert();
-	return ret;
-    }
-    res->size = ret;
+    _gnutls_bin2hex(data->data, data->size, result, *result_size);
 
     return 0;
 }
 
-#endif				/* ENABLE_SRP */
+
+#endif				/* ENABLE_PSK */
diff --git a/src/serv-gaa.c b/src/serv-gaa.c
index 7b010600a6..94dd052e58 100644
--- a/src/serv-gaa.c
+++ b/src/serv-gaa.c
@@ -145,6 +145,7 @@ void gaa_help(void)
 	__gaa_helpsingle(0, "x509dsakeyfile", "FILE ", "Alternative X.509 key file to use.");
 	__gaa_helpsingle(0, "x509dsacertfile", "FILE ", "Alternative X.509 certificate file to use.");
 	__gaa_helpsingle(0, "require-cert", "", "Require a valid certificate.");
+	__gaa_helpsingle(0, "pskpasswd", "FILE ", "PSK password file to use.");
 	__gaa_helpsingle(0, "srppasswd", "FILE ", "SRP password file to use.");
 	__gaa_helpsingle(0, "srppasswdconf", "FILE ", "SRP password conf file to use.");
 	__gaa_helpsingle(0, "ciphers", "cipher1 cipher2... ", "Ciphers to enable.");
@@ -171,34 +172,36 @@ typedef struct _gaainfo gaainfo;
 
 struct _gaainfo
 {
-#line 98 "serv.gaa"
+#line 101 "serv.gaa"
 	char **ctype;
-#line 97 "serv.gaa"
+#line 100 "serv.gaa"
 	int nctype;
-#line 94 "serv.gaa"
+#line 97 "serv.gaa"
 	char **kx;
-#line 93 "serv.gaa"
+#line 96 "serv.gaa"
 	int nkx;
-#line 90 "serv.gaa"
+#line 93 "serv.gaa"
 	char **macs;
-#line 89 "serv.gaa"
+#line 92 "serv.gaa"
 	int nmacs;
-#line 86 "serv.gaa"
+#line 89 "serv.gaa"
 	char **comp;
-#line 85 "serv.gaa"
+#line 88 "serv.gaa"
 	int ncomp;
-#line 82 "serv.gaa"
+#line 85 "serv.gaa"
 	char **proto;
-#line 81 "serv.gaa"
+#line 84 "serv.gaa"
 	int nproto;
-#line 78 "serv.gaa"
+#line 81 "serv.gaa"
 	char **ciphers;
-#line 77 "serv.gaa"
+#line 80 "serv.gaa"
 	int nciphers;
-#line 73 "serv.gaa"
+#line 76 "serv.gaa"
 	char *srp_passwd_conf;
-#line 70 "serv.gaa"
+#line 73 "serv.gaa"
 	char *srp_passwd;
+#line 70 "serv.gaa"
+	char *psk_passwd;
 #line 67 "serv.gaa"
 	int require_cert;
 #line 64 "serv.gaa"
@@ -291,7 +294,7 @@ static int gaa_error = 0;
 #define GAA_MULTIPLE_OPTION     3
 
 #define GAA_REST                0
-#define GAA_NB_OPTION           32
+#define GAA_NB_OPTION           33
 #define GAAOPTID_copyright	1
 #define GAAOPTID_version	2
 #define GAAOPTID_help	3
@@ -304,26 +307,27 @@ static int gaa_error = 0;
 #define GAAOPTID_ciphers	10
 #define GAAOPTID_srppasswdconf	11
 #define GAAOPTID_srppasswd	12
-#define GAAOPTID_require_cert	13
-#define GAAOPTID_x509dsacertfile	14
-#define GAAOPTID_x509dsakeyfile	15
-#define GAAOPTID_x509certfile	16
-#define GAAOPTID_x509keyfile	17
-#define GAAOPTID_pgpcertfile	18
-#define GAAOPTID_pgpkeyfile	19
-#define GAAOPTID_pgptrustdb	20
-#define GAAOPTID_pgpkeyring	21
-#define GAAOPTID_x509crlfile	22
-#define GAAOPTID_x509cafile	23
-#define GAAOPTID_x509fmtder	24
-#define GAAOPTID_dhparams	25
-#define GAAOPTID_echo	26
-#define GAAOPTID_http	27
-#define GAAOPTID_nodb	28
-#define GAAOPTID_quiet	29
-#define GAAOPTID_port	30
-#define GAAOPTID_generate	31
-#define GAAOPTID_debug	32
+#define GAAOPTID_pskpasswd	13
+#define GAAOPTID_require_cert	14
+#define GAAOPTID_x509dsacertfile	15
+#define GAAOPTID_x509dsakeyfile	16
+#define GAAOPTID_x509certfile	17
+#define GAAOPTID_x509keyfile	18
+#define GAAOPTID_pgpcertfile	19
+#define GAAOPTID_pgpkeyfile	20
+#define GAAOPTID_pgptrustdb	21
+#define GAAOPTID_pgpkeyring	22
+#define GAAOPTID_x509crlfile	23
+#define GAAOPTID_x509cafile	24
+#define GAAOPTID_x509fmtder	25
+#define GAAOPTID_dhparams	26
+#define GAAOPTID_echo	27
+#define GAAOPTID_http	28
+#define GAAOPTID_nodb	29
+#define GAAOPTID_quiet	30
+#define GAAOPTID_port	31
+#define GAAOPTID_generate	32
+#define GAAOPTID_debug	33
 
 #line 168 "gaa.skel"
 
@@ -558,6 +562,12 @@ struct GAAOPTION_srppasswd
 	int size1;
 };
 
+struct GAAOPTION_pskpasswd 
+{
+	char* arg1;
+	int size1;
+};
+
 struct GAAOPTION_x509dsacertfile 
 {
 	char* arg1;
@@ -673,6 +683,7 @@ static int gaa_get_option_num(char *str, int status)
 			GAA_CHECK1STR("", GAAOPTID_ciphers);
 			GAA_CHECK1STR("", GAAOPTID_srppasswdconf);
 			GAA_CHECK1STR("", GAAOPTID_srppasswd);
+			GAA_CHECK1STR("", GAAOPTID_pskpasswd);
 			GAA_CHECK1STR("", GAAOPTID_x509dsacertfile);
 			GAA_CHECK1STR("", GAAOPTID_x509dsakeyfile);
 			GAA_CHECK1STR("", GAAOPTID_x509certfile);
@@ -715,6 +726,7 @@ static int gaa_get_option_num(char *str, int status)
 			GAA_CHECKSTR("ciphers", GAAOPTID_ciphers);
 			GAA_CHECKSTR("srppasswdconf", GAAOPTID_srppasswdconf);
 			GAA_CHECKSTR("srppasswd", GAAOPTID_srppasswd);
+			GAA_CHECKSTR("pskpasswd", GAAOPTID_pskpasswd);
 			GAA_CHECKSTR("require-cert", GAAOPTID_require_cert);
 			GAA_CHECKSTR("x509dsacertfile", GAAOPTID_x509dsacertfile);
 			GAA_CHECKSTR("x509dsakeyfile", GAAOPTID_x509dsakeyfile);
@@ -755,6 +767,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	struct GAAOPTION_ciphers GAATMP_ciphers;
 	struct GAAOPTION_srppasswdconf GAATMP_srppasswdconf;
 	struct GAAOPTION_srppasswd GAATMP_srppasswd;
+	struct GAAOPTION_pskpasswd GAATMP_pskpasswd;
 	struct GAAOPTION_x509dsacertfile GAATMP_x509dsacertfile;
 	struct GAAOPTION_x509dsakeyfile GAATMP_x509dsakeyfile;
 	struct GAAOPTION_x509certfile GAATMP_x509certfile;
@@ -790,28 +803,28 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
     {
 	case GAAOPTID_copyright:
 	OK = 0;
-#line 106 "serv.gaa"
+#line 109 "serv.gaa"
 { print_serv_license(); exit(0); ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_version:
 	OK = 0;
-#line 105 "serv.gaa"
+#line 108 "serv.gaa"
 { serv_version(); exit(0); ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_help:
 	OK = 0;
-#line 103 "serv.gaa"
+#line 106 "serv.gaa"
 { gaa_help(); exit(0); ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_list:
 	OK = 0;
-#line 102 "serv.gaa"
+#line 105 "serv.gaa"
 { print_list(); exit(0); ;};
 
 		return GAA_OK;
@@ -819,7 +832,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	case GAAOPTID_ctypes:
 	OK = 0;
 		GAA_LIST_FILL(GAATMP_ctypes.arg1, gaa_getstr, char*, GAATMP_ctypes.size1);
-#line 99 "serv.gaa"
+#line 102 "serv.gaa"
 { gaaval->ctype = GAATMP_ctypes.arg1; gaaval->nctype = GAATMP_ctypes.size1 ;};
 
 		return GAA_OK;
@@ -827,7 +840,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	case GAAOPTID_kx:
 	OK = 0;
 		GAA_LIST_FILL(GAATMP_kx.arg1, gaa_getstr, char*, GAATMP_kx.size1);
-#line 95 "serv.gaa"
+#line 98 "serv.gaa"
 { gaaval->kx = GAATMP_kx.arg1; gaaval->nkx = GAATMP_kx.size1 ;};
 
 		return GAA_OK;
@@ -835,7 +848,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	case GAAOPTID_macs:
 	OK = 0;
 		GAA_LIST_FILL(GAATMP_macs.arg1, gaa_getstr, char*, GAATMP_macs.size1);
-#line 91 "serv.gaa"
+#line 94 "serv.gaa"
 { gaaval->macs = GAATMP_macs.arg1; gaaval->nmacs = GAATMP_macs.size1 ;};
 
 		return GAA_OK;
@@ -843,7 +856,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	case GAAOPTID_comp:
 	OK = 0;
 		GAA_LIST_FILL(GAATMP_comp.arg1, gaa_getstr, char*, GAATMP_comp.size1);
-#line 87 "serv.gaa"
+#line 90 "serv.gaa"
 { gaaval->comp = GAATMP_comp.arg1; gaaval->ncomp = GAATMP_comp.size1 ;};
 
 		return GAA_OK;
@@ -851,7 +864,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	case GAAOPTID_protocols:
 	OK = 0;
 		GAA_LIST_FILL(GAATMP_protocols.arg1, gaa_getstr, char*, GAATMP_protocols.size1);
-#line 83 "serv.gaa"
+#line 86 "serv.gaa"
 { gaaval->proto = GAATMP_protocols.arg1; gaaval->nproto = GAATMP_protocols.size1 ;};
 
 		return GAA_OK;
@@ -859,7 +872,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	case GAAOPTID_ciphers:
 	OK = 0;
 		GAA_LIST_FILL(GAATMP_ciphers.arg1, gaa_getstr, char*, GAATMP_ciphers.size1);
-#line 79 "serv.gaa"
+#line 82 "serv.gaa"
 { gaaval->ciphers = GAATMP_ciphers.arg1; gaaval->nciphers = GAATMP_ciphers.size1 ;};
 
 		return GAA_OK;
@@ -869,7 +882,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_srppasswdconf.arg1, gaa_getstr, GAATMP_srppasswdconf.size1);
 		gaa_index++;
-#line 74 "serv.gaa"
+#line 77 "serv.gaa"
 { gaaval->srp_passwd_conf = GAATMP_srppasswdconf.arg1 ;};
 
 		return GAA_OK;
@@ -879,9 +892,19 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_srppasswd.arg1, gaa_getstr, GAATMP_srppasswd.size1);
 		gaa_index++;
-#line 71 "serv.gaa"
+#line 74 "serv.gaa"
 { gaaval->srp_passwd = GAATMP_srppasswd.arg1 ;};
 
+		return GAA_OK;
+		break;
+	case GAAOPTID_pskpasswd:
+	OK = 0;
+		GAA_TESTMOREARGS;
+		GAA_FILL(GAATMP_pskpasswd.arg1, gaa_getstr, GAATMP_pskpasswd.size1);
+		gaa_index++;
+#line 71 "serv.gaa"
+{ gaaval->psk_passwd = GAATMP_pskpasswd.arg1 ;};
+
 		return GAA_OK;
 		break;
 	case GAAOPTID_require_cert:
@@ -1087,7 +1110,7 @@ int gaa(int argc, char **argv, gaainfo *gaaval)
     if(inited == 0)
     {
 
-#line 109 "serv.gaa"
+#line 112 "serv.gaa"
 { gaaval->generate=0; gaaval->port=5556; gaaval->http=0; gaaval->ciphers=NULL;
 	gaaval->kx=NULL; gaaval->comp=NULL; gaaval->macs=NULL; gaaval->ctype=NULL; gaaval->nciphers=0;
 	gaaval->nkx=0; gaaval->ncomp=0; gaaval->nmacs=0; gaaval->nctype = 0; gaaval->nodb = 0;
@@ -1096,7 +1119,7 @@ int gaa(int argc, char **argv, gaainfo *gaaval)
 	gaaval->x509_dsakeyfile=NULL; gaaval->x509_dsacertfile=NULL; 
 	gaaval->srp_passwd=NULL; gaaval->srp_passwd_conf=NULL; gaaval->quiet = 0;
 	gaaval->pgp_trustdb=NULL; gaaval->pgp_keyring=NULL; gaaval->fmtder = 0; 
-	gaaval->dh_params_file=NULL; gaaval->debug=0; gaaval->require_cert = 0; ;};
+	gaaval->dh_params_file=NULL; gaaval->debug=0; gaaval->require_cert = 0; gaaval->psk_passwd = 0; ;};
 
     }
     inited = 1;
diff --git a/src/serv-gaa.h b/src/serv-gaa.h
index f46930fc00..3d6b2ec2cf 100644
--- a/src/serv-gaa.h
+++ b/src/serv-gaa.h
@@ -8,34 +8,36 @@ typedef struct _gaainfo gaainfo;
 
 struct _gaainfo
 {
-#line 98 "serv.gaa"
+#line 101 "serv.gaa"
 	char **ctype;
-#line 97 "serv.gaa"
+#line 100 "serv.gaa"
 	int nctype;
-#line 94 "serv.gaa"
+#line 97 "serv.gaa"
 	char **kx;
-#line 93 "serv.gaa"
+#line 96 "serv.gaa"
 	int nkx;
-#line 90 "serv.gaa"
+#line 93 "serv.gaa"
 	char **macs;
-#line 89 "serv.gaa"
+#line 92 "serv.gaa"
 	int nmacs;
-#line 86 "serv.gaa"
+#line 89 "serv.gaa"
 	char **comp;
-#line 85 "serv.gaa"
+#line 88 "serv.gaa"
 	int ncomp;
-#line 82 "serv.gaa"
+#line 85 "serv.gaa"
 	char **proto;
-#line 81 "serv.gaa"
+#line 84 "serv.gaa"
 	int nproto;
-#line 78 "serv.gaa"
+#line 81 "serv.gaa"
 	char **ciphers;
-#line 77 "serv.gaa"
+#line 80 "serv.gaa"
 	int nciphers;
-#line 73 "serv.gaa"
+#line 76 "serv.gaa"
 	char *srp_passwd_conf;
-#line 70 "serv.gaa"
+#line 73 "serv.gaa"
 	char *srp_passwd;
+#line 70 "serv.gaa"
+	char *psk_passwd;
 #line 67 "serv.gaa"
 	int require_cert;
 #line 64 "serv.gaa"