So there is this TLS Session resumption method using Session Tickets which transfers the TLS server secret state to the client (encrypted and authenticated with a key only known to the server)

If a client wants to resume a session, he simply includes the Session Ticket in the request, which allows the server to resume the session.


  • What happens if the Session key (server) is stolen?
  • What could an attacker do if he records ALL packets between the server and various clients? Will he be able to decrypt everything?

The Session Ticket includes the master_secret (which is used for symmetric crypto like AES?) (RFC 5077, page 11).

  • How exactly is this master_secret reused after Session resumption? Will server and client continue to reuse this master_secret for all symmetric crypto (e.g. AES)?

Ticket crypto broken -> PFS broken.

I believe this quote from a great CloudFlare blog post answers each of your questions.

this key becomes [a] critical single point of failure for TLS security: if an adversary gets hold of it, the session key information is exposed for every session ticket! Even after the lifetime of a session ticket, such a loss would invalidate supposed “perfect forward secrecy” (as evangelized here on our blog).

Therefore, it is important to:
“generate session ticket keys randomly, distribute them to the servers without ever touching persistent storage and rotate them frequently.” (Adam Langley)

And they link to a blog post by Adam Langley that gives background for this:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.