Re: [TLS] Question on Stateless TLS Session Resumption

Lakshminath Dondeti <ldondeti@qualcomm.com> writes:
>> However, as you indicate, you might want to explicitly terminate
>> a session. As Vidya indicated, this requires server side state,
>> though less than a session cache would require.
>
> Right, this is what I was pointing out as "difficult" (for some degree
> of difficulty :) ).  Either we need more state or more state plus some
> more computation to invalidate a ticket (I am thinking a hash
> computation), if the identity (session id) is not fixed. 

Actually, the existence of the session ID doesn't change matters
much at all. Whatever operations you would follow with the
session ID you follow with the ticket. 

> Yes, I took
> a quick at the relevant portions of the paper you cite, but that
> analysis assumes that there is a session id and assumes that the
> server has a blacklist of invalidated sessions.

RFC 4507 has both a ticket and a session ID. BSR04 uses the
ticket as the session ID.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls