[TLS] Session resumption ticket reuse considered harmful

[Nico Williams <[e-mail]>]

... unless both parties agree.  It takes two to agree.

What are the problems with ticket reuse?  Well:

1) session linkage

2) early data doesn't get rekeyed, so you get key reuse and the early
   data is replayable

In the case of SMTP, however, (1) is not a problem for obvious reasons,
and (2) is N/A.

For SUBMIT, (1) is a problem, so don't allow it, and (2) is N/A.

SMTP doesn't care about session linkage because it's MTA<->MTA traffic
that is already aggregating multiple users' traffic, plus email is
store-and-forward, so there is no real privacy loss for users.

Nico
--