Re: [TLS] Unifying tickets and sessions

[Hubert Kario <[e-mail]>]

On Wednesday 22 October 2014 19:09:37 Viktor Dukhovni wrote:
> On Wed, Oct 22, 2014 at 08:42:15PM +0200, Richard Fussenegger wrote:
> > Viktor Dukhovni already mentioned that
> > OpenSSL is actually supporting different key strengths, but for instance
> > nginx isn't exposing this setting to administrators.
> 
> For the record OpenSSL makes it possible for applications to use
> some other block cipher than aes-128-cbc, but this is not as easy
> as it sounds.  The application needs to register appropriate
> callbacks and take over key life-cycle management.  So simply using
> some other cipher-suite is not a trivial exercise, rather only once
> one is already managing key rotation via the callbacks, making the
> cipher configurable is trivial:
> 
<snip>
> Perhaps I'll donate a variant of this code to OpenSSL, and then we
> can ask users to just provide algorithm name, and either a key
> lifetime for automatic in memory keys or callbacks to access
> externally managed keys.

I'd really like to see such code in OpenSSL. It would certainly help to make 
sure that the TLS 1.3 implementation meets the goals of TLS 1.3 charter.

-- 
Regards,
Hubert Kario