2

So there is this TLS Session resumption method using Session Tickets which transfers the TLS server secret state to the client (encrypted and authenticated with a key only known to the server)

If a client wants to resume a session, he simply includes the Session Ticket in the request, which allows the server to resume the session.

Questions:

  • What happens if the Session key (server) is stolen?
  • What could an attacker do if he records ALL packets between the server and various clients? Will he be able to decrypt everything?

The Session Ticket includes the master_secret (which is used for symmetric crypto like AES?) (RFC 5077, page 11).

  • How exactly is this master_secret reused after Session resumption? Will server and client continue to reuse this master_secret for all symmetric crypto (e.g. AES)?

1 Answer 1

6

Ticket crypto broken -> PFS broken.

I believe this quote from a great CloudFlare blog post answers each of your questions.

this key becomes [a] critical single point of failure for TLS security: if an adversary gets hold of it, the session key information is exposed for every session ticket! Even after the lifetime of a session ticket, such a loss would invalidate supposed “perfect forward secrecy” (as evangelized here on our blog).

Therefore, it is important to:
“generate session ticket keys randomly, distribute them to the servers without ever touching persistent storage and rotate them frequently.” (Adam Langley)

And they link to a blog post by Adam Langley that gives background for this:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .