Re: [TLS] Unifying tickets and sessions

[Viktor Dukhovni <[e-mail]>]

On Thu, Oct 23, 2014 at 07:21:08PM +0200, Richard Fussenegger wrote:

> To answer Rich Salz's initial question, if we'd have 24h encryption and 72h
> decryption on the server-side (as I proposed and nobody said anything pro or
> contra)

There is another variable at play here, in many implementations
there is a potentially independent upper bound on the lifetime of
resumed sessions, whether stateful or otherwise.

In Postfix (which is based on OpenSSL) I arrange for the session
lifetime limit to be double the key rotation interval.  Say that
is 1 hour, then the session lifetime is set to 2 hours.  Each key
is used to encrypt new traffic for an hour, then it becomes the
cached decryption key and a new encryption key is used.

There are only ever two keys sets in memory: the current encryption
key set and prior encryption (additional decryption) keyset.  I
say key set because we need an encryption key and an HMAC key and
both are rotated together, with these is associated a 16 octent id
(could be a counter or simply random).

> the MUST NOT for ticket/token lifetime would become 48h.
> 
> server-side key:
>          24h enc
> |------------------------|         24h denc
>                          |------------------------|        24h denc
> |------------------------|
> client:
>                                                 48h
> |-------------------------------------------------|

The set of sessions encrypted under a single key is still 24 hours,
but the length of time for which the key is exposed on the server
is 48 hours.  And indeed a session is valid for anywhere between
24 and 48 hours depending on when in the encryption key's lifetime
it got created.

> If the client receives a ticket/token just before the first rotation, it can
> revisit within 48h and the ticket/token is still valid if three keys are in
> use.

Actually two key sets are sufficient.  There is no need for a third
key set.  Take a look at postfix/src/tls/tls_scache.c the relevant
functions are tls_scache_key() and tls_scache_key_rotate().

This is used in postfix/src/tls/tls_mgr.c tls_mgr_key().

    https://github.com/vdukhovni/postfix

-- 
	Viktor.