[TLS] Question on Stateless TLS Session Resumption

All,
RFC4507 makes no mention of ticket replays at all, which I find to be a
bit surprising. It actually doesn't talk about message replays either,
but, since the protocol takes 1.5 RTs,  both parties prove to be live
and so, that is not a problem. But, ticket replays seem to be of some
concern. Based on the fact that the ticket contains a timestamp, using
which expiry can be determined, it appears that a given ticket will be
accepted until its expiry time, even if a newer ticket may have been
issued after that. This itself is not so much a problem, since, the
client really has no incentive in using an older ticket as opposed to
the latest one. However, if a new ticket is either not issued or if the
session is terminated by the server for some reason, this seems to be a
problem. Since there is really no means of ticket revocation or any
server state on the status of a ticket, there seems to be no way to
determine that the client is not supposed to be using that ticket to
resume a session. Also, the fact that the client is allowed to pick a
Session ID makes it infeasible to track a terminated session that must
not be allowed to resume. 

Am I missing something? Has this been talked about before? 

Vidya

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls