RE: [TLS] Stateless TLS Session Resumption extension and EAP-FAST.

Hi Jan,

You are correct, there is an issue with current implementation.  Thanks
for pointing this out.  Details follow:

Current EAP-FAST implementations do not format the extension correctly
as to spec.  They leave out one of the length fields.

EAP-FAST implementation:

      struct {
  	   uint16 extensionType 	
 	   opaque ticket<0..2^16-1>
      } SessionTicketExtension

Example encoding: 00 23 LL LL TT TT TT ...

LL - ticket length
TT - ticket

RFC4507:

>     struct {
>        opaque ticket<0..2^16-1>;
>     } SessionTicket;
>
>    struct {
>  	   uint16 extensionType 	
> 	   opaque SessionTicket<0..2^16-1>
>    } SessionTicketExtension
>

Example encoding: 00 23 LN LN LL LL TT TT TT....

LN - length of ticket + 2-bytes

Joe 

> -----Original Message-----
> From: Jan Nordqvist [mailto:jnordqvist@alcatel-lucent.com] 
> Sent: Thursday, March 01, 2007 11:52 AM
> To: tls@ietf.org
> Subject: [TLS] Stateless TLS Session Resumption extension and 
> EAP-FAST.
> 
> I apologize if this gets duplicated, I had the wrong address 
> registered:
> 
> During some recent work incorporating EAP-FAST support into 
> our TLS stack I have discovered that the devices we use for 
> testing are violating the format of the stateless session 
> ticket extension definition per RFC-4507. In all instances I 
> have seen, the whole SessionTicket is preceded by a two-byte 
> 'type' field, i.e. the definition is really
> 
> struct {
>     uint16 type;
>     opaque ticket<0..2^16-1>;
> } SessionTicket;
> 
> I don't know the size of deployments of EAP-FAST devices 
> versus other implementations using the session ticket 
> extension, but it seems that either RFC-4507 needs to be 
> updated to reflect what is actually implemented or perhaps 
> the extension should be split into two.
> 
> Regards,
> Jan Nordqvist
> 
> 
> _______________________________________________
> TLS mailing list
> TLS@lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/tls
> 

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls