Contents
How is the PSK key used in session resumption?
Two PSK key exchange modes are defined, psk_ke and psk_dhe_ke. The first signals a key exchange using a previously shared key, it derives a new master secret from only the PSK and nonces. This basically is as (in)secure as session resumption in TLS 1.2 if the server never rotates keys or discards cache entries long after they expired.
Why is session resumption bad for forward secrecy?
Session resumption can harm the effectiveness of forward secrecy by continuing to reuse sessions. In some cases a badly configured server can completely negate all the benefits of forward secrecy by configuring their server to store resumption details for a long period of time.
What is the purpose of session resumption in SSL?
Session resumption is actually a performance feature to reduce latency of subsequent requests to the same server made within a short span of time. There is a reason some servers return a session ID then refuse to accept it (which this test is complaining about).
What happens to cache entries in session resumption?
Session cache entries though aren’t evicted until access just like with the other web servers. But even for “traditional” web servers all is not lost. The TLS working group has known about the shortcomings of session resumption for a while and addresses those with the next version of TLS.
How does session resumption work in TLS 1.3?
The draft of TLS 1.3 replaces session IDs and session tickets with the concept of session resumption via pre-shared keys (PSK). After the initial handshake, the server sends a PSK identity to the client.
What are the shortcomings of session resumption?
The TLS working group has known about the shortcomings of session resumption for a while and addresses those with the next version of TLS. One of the many great things about TLS 1.3 handshakes is that most connections should take only a single round-trip to establish.