Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same time to concurrently load multiple resources such as javascript, css & image files, and I assume pages served with HTTPS do the same.
1 Answer
Browsers try to reuse the same TLS session for multiple TCP connections to the same server. But if this is possible depends on the server: if the server does not support session reuse a full handshake need to be done for each new TLS connection.
If session gets reused or not can be seen at least until TLS 1.2 in the developer tools in the browser. In the waterfall diagram of a request it gives the timing for the SSL handshake and one can compare the different timings: the first is usually longer than the rest since a full handshake (no resume) takes more time (3 RTT) than a abbreviated handshake (resume, 2 RTT).
answered Nov 21, 2018 at 19:26
-
Steffen's answer cuts across multiple issues without answering the question posed. It is true that browsers use "Connection: Keep alive" to keep sockets open to reduce overhead. It's also true that browsers use "socket pooling" to minimize the number of concurrent connections to a given server, and that TLS uses a Session-Id to avoid repeating the initial handshake that sets up a secure session. It does not follow from any of this, however, that the multiple sockets a browser uses in concurrent TLS connections to the same server use the same Session keys. A vendor used WireShark to monitor suc Dec 5, 2018 at 19:38
-
Through 1.2 even when the session, and its master secret, is reused, the working key values (plural, 2-6 of them) for each connection are different; see e.g. crypto.stackexchange.com/questions/50799/… and links there, including my comment about resumption. For 1.3 there is no resumption as such, instead you can label and use a derived secret from the prior session as a 'PSK' either alone or with a new ephemeral exchange for a new session. Jan 5, 2019 at 6:48