Re: [TLS] Unifying tickets and sessions

[Viktor Dukhovni <[e-mail]>]

On Thu, Oct 23, 2014 at 08:55:28PM +0200, Richard Fussenegger wrote:

> On 10/23/2014 8:36 PM, Viktor Dukhovni wrote:
> >The iv should not be part of the persistent key set.  It is a new
> >random value for each client, returned to the server as part of
> >the ticket.  The key set is just (name, key, mac).  The in memory
> >version in Postfix also holds a timeout:
> >
> >     typedef struct TLS_TICKET_KEY {
> >	unsigned char name[TLS_TICKET_NAMELEN];
> >	unsigned char bits[TLS_TICKET_KEYLEN];
> >	unsigned char hmac[TLS_TICKET_MACLEN];
> >	time_t  tout;
> >     } TLS_TICKET_KEY;
> 
> I didn't implement it but nginx requires 48 B otherwise it's not working and
> that's definitely more than only key and mac. Maybe the complete thing is
> broken in nginx then? [1]

The reason nginx has 48 bytes is that it stores a 16 byte name,
followed by a 16-byte (AES-128) key and a 16-byte HMAC secret.

Postfix uses 16 + 32 + 32 = 80, because the key is for AES-256 and
the HMAC key for SHA2-256 is also chosen to be 256 bits.

The nginx implementation can be "strengthened" from AES-128 to
AES-256 just in case someone wants to burn a few million years of
a 4GW power plant to brute force a session ticket on a classical
computer, or future quantum computers can search a 2^128 key space
in 2^64 time.

-- 
	Viktor.