Re: [TLS] SNI and tickets and resumption

[Antoine Delignat-Lavaud <[e-mail]>]

Le 8/11/2014 5:02 AM, Brian Sniffen a écrit :
>> Essentially, whenever a full handshake would result in the use of the
>> same server certificate as the resumption proposed by the client,
>> my server will perform session resumption, and ingnore SNI mismatches.
> So if a server has a giant SAN cert for `eff.org` and `nsa.gov`, and a
> session with one is resumed to the other---that's unsurprising?  I don't
> see a path all the way through to an attack, but it leads me to worry
> about a web app and a web server interacting in this way.

Yes, it *is* indeed unsurprising: this behavior is the standard in SPDY 
and in the current HTTP2 draft even though it goes against the spirit of 
RFC 6066 -- see my message in the thread "inter-protocol attacks".
Moreover, current webservers will also proceed with resumption even if 
the SNI provided by the client would have resulted in the server picking 
a different certificate. This is why resumption can be used to bypass 
certificate validation - this problem is related to yet another TLS API 
problem with the SNI callback. In many cases, the application may not 
even get to see the certificate selection callback from TLS when doing 
resumption.

Best,

Antoine Delignat-Lavaud