Re: [TLS] Unifying tickets and sessions

[Richard Fussenegger <[e-mail]>]

On 10/23/2014 10:07 PM, Viktor Dukhovni wrote:
> On Thu, Oct 23, 2014 at 08:55:28PM +0200, Richard Fussenegger wrote:
>> I didn't implement it but nginx requires 48 B otherwise it's not working and
>> that's definitely more than only key and mac. Maybe the complete thing is
>> broken in nginx then? [1]
>
> The reason nginx has 48 bytes is that it stores a 16 byte name,
> followed by a 16-byte (AES-128) key and a 16-byte HMAC secret.

Oh silly me, I could have found that myself: 
https://github.com/nginx/nginx/blob/master/src/event/ngx_event_openssl.h#L99-L107

> Postfix uses 16 + 32 + 32 = 80, because the key is for AES-256 and
> the HMAC key for SHA2-256 is also chosen to be 256 bits.
>
> The nginx implementation can be "strengthened" from AES-128 to
> AES-256 just in case someone wants to burn a few million years of
> a 4GW power plant to brute force a session ticket on a classical
> computer, or future quantum computers can search a 2^128 key space
> in 2^64 time.

But then nginx needs additional code, as you wrote earlier. It would be 
better (and that's also what the nginx devs want) if the library takes 
care of all that. Right now nginx has not a single line of code for 
session tickets (beside that function for external key sets). Well, we 
can only hope that you might take care of that and commit some OpenSSL 
code. ;-)

Richard