Re: [TLS] Unifying tickets and sessions

[Viktor Dukhovni <[e-mail]>]

On Thu, Oct 23, 2014 at 08:17:33PM +0200, Richard Fussenegger wrote:

> I like the wording 'key set' and it's actually what I was referring to too.
> The key sets that are generated in my script for nginx are simply 48 B of
> random data (key_name, iv, key, mac):

The iv should not be part of the persistent key set.  It is a new
random value for each client, returned to the server as part of
the ticket.  The key set is just (name, key, mac).  The in memory
version in Postfix also holds a timeout:

    typedef struct TLS_TICKET_KEY {
	unsigned char name[TLS_TICKET_NAMELEN];
	unsigned char bits[TLS_TICKET_KEYLEN];
	unsigned char hmac[TLS_TICKET_MACLEN];
	time_t  tout;
    } TLS_TICKET_KEY;

> I adopted the three key idea from Twitter[1] and yes two key sets are
> sufficient. I thought that Twitters rationale behind the three keys was to
> extend the lifetime of tickets on the client side (as in my drawing
> http://pastebin.com/1iAatbWm) without extending the lifetime of the
> encryption key. Of course I could be terribly wrong here but Jacob
> Hoffman-Andrews for sure had some idea behind this rationale.

There is no particular advantage to three keys,  it just means that
the range of session lifetimes is between 2T and 3T, rather than
between T and 2T, if that's compelling (less variance) go for it.

> If the upper limit is said to be two tickets, Twitter has to adopt there
> system. Since we already have a prominent example that uses three tickets,
> its imho a good idea to let them continue doing so. Note that your approach
> would still be perfectly valid because you're below the hard limit of three
> tickets.

I think you mean "key sets" not "tickets", and still I have no idea
what the above is talking about.  There is no "hard limit".  One
can use 24 keysets each good for encryption for 1 hour and decryption
for 23 after that.  It just means more data to shuffle in memory.
I used 2 key sets because it was simpler.

> That said, I have no problem with two keys especially if there is an
> argument against using three keys in regards to security. Maybe I should ask
> Jacob Hoffman-Andrews from Twitter why they are using three keys?

The number of key sets is irrelevant, all that matters is how long
each one is retained.  Postfix defaults to 2 hours (1 hour encrypt
and 1 hour decrypt).  With N keysets, you'd have (T encrypt, (N-1)*T
decrypt).

-- 
	Viktor.