Re: [TLS] Unifying tickets and sessions

[Richard Fussenegger <[e-mail]>]

On 10/23/2014 8:36 PM, Viktor Dukhovni wrote:
> The iv should not be part of the persistent key set.  It is a new
> random value for each client, returned to the server as part of
> the ticket.  The key set is just (name, key, mac).  The in memory
> version in Postfix also holds a timeout:
>
>      typedef struct TLS_TICKET_KEY {
> 	unsigned char name[TLS_TICKET_NAMELEN];
> 	unsigned char bits[TLS_TICKET_KEYLEN];
> 	unsigned char hmac[TLS_TICKET_MACLEN];
> 	time_t  tout;
>      } TLS_TICKET_KEY;

I didn't implement it but nginx requires 48 B otherwise it's not working 
and that's definitely more than only key and mac. Maybe the complete 
thing is broken in nginx then? [1]

> I think you mean "key sets" not "tickets", and still I have no idea
> what the above is talking about.  There is no "hard limit".  One
> can use 24 keysets each good for encryption for 1 hour and decryption
> for 23 after that.  It just means more data to shuffle in memory.
> I used 2 key sets because it was simpler.

Absolutely, I meant 'key sets' not tickets. Well, I proposed that three 
key sets could become a hard limit and was referring to that proposition 
[2] because: [3]

> otherwise there's a hole in the RFC that allows people to keep keys 
> until their storage runs out

You may swap 'storage' with 'RAM' in that sentence, doesn't matter.

Richard

[1] 
https://github.com/nginx/nginx/blob/bb8c0683da773566e09797ef8a4ee00ad1e0f956/src/event/ngx_event_openssl.c#L2628-L2739
[2] http://www.ietf.org/mail-archive/web/tls/current/msg14168.html
[3] http://www.ietf.org/mail-archive/web/tls/current/msg14188.html