Re: [TLS] Unifying tickets and sessions

[Nico Williams <[e-mail]>]

On Thu, Oct 23, 2014 at 01:27:08AM +0200, Manuel Pégourié-Gonnard wrote:
> I don't think this is correct. Once the server emits the ticket (if we're
> speaking about a ticket that contains session state including the MS), it's out
> there in the clear* for an attacker to play with. That the client chooses to
> ignore the ticket doesn't change that fact.
>
> [...]
>
> * For TLS 1.2 I mean. For 1.3 that might be different.

The ticket has to always be sent in the clear during resumption,
otherwise there's no point in having session resumption with tickets :)

The key material to super-protect a ticket would have to come from
somewhere: if not the ticket, then from a slower key exchange... that
session resumption means to avoid.

Nico
--