Re: [TLS] Unifying tickets and sessions

[Viktor Dukhovni <[e-mail]>]

On Thu, Oct 23, 2014 at 03:35:59PM -0400, Stephen Checkoway wrote:

> On Oct 23, 2014, at 2:36 PM, Viktor Dukhovni <[e-mail]> wrote:
> 
> > The number of key sets is irrelevant, all that matters is how long
> > each one is retained.  Postfix defaults to 2 hours (1 hour encrypt
> > and 1 hour decrypt).  With N keysets, you'd have (T encrypt, (N-1)*T
> > decrypt).
> 
> This seems perfectly reasonable (both for general N and for
> specific N = 2 or N = 3). But does it make any difference from a
> protocol perspective? The only way a client could tell if a server
> is doing something wrong is if the client knows the upper limit on
> the ticket's validity  NT and sends a ticket after that time which
> the server accepts.

OpenSSL at least enforces the N*T time-limit on sessions, and in
case would not be able to decrypt a session ticket whose key has
been discarded.  So Postfix sets 2*T as the session lifetime, and
as a result if a session ticket is decrypted the session will not
be accepted.


> I'm probably missing something but it seems like there's no real way to
> detect if the server has followed any particular policy for a ticket so
> the details (such as key rotation and symmetric algorithm strength) should
> be left entirely up to the server. (Or resumption should be dropped from
> 1.3.)

Indeed the client has no way to know whether the server has erased
previous session ticket keys.

> Giving guidance seems reasonable. Setting unenforceable limits does not.

I have no opinion on whether any limit needs to be "enforceable".
Key rotation needs to happen, but the client has no way to verify,
that's just life.

-- 
	Viktor.