0

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same time to concurrently load multiple resources such as javascript, css & image files, and I assume pages served with HTTPS do the same.

1

Browsers try to reuse the same TLS session for multiple TCP connections to the same server. But if this is possible depends on the server: if the server does not support session reuse a full handshake need to be done for each new TLS connection.

If session gets reused or not can be seen at least until TLS 1.2 in the developer tools in the browser. In the waterfall diagram of a request it gives the timing for the SSL handshake and one can compare the different timings: the first is usually longer than the rest since a full handshake (no resume) takes more time (3 RTT) than a abbreviated handshake (resume, 2 RTT).

  • Steffen's answer cuts across multiple issues without answering the question posed. It is true that browsers use "Connection: Keep alive" to keep sockets open to reduce overhead. It's also true that browsers use "socket pooling" to minimize the number of concurrent connections to a given server, and that TLS uses a Session-Id to avoid repeating the initial handshake that sets up a secure session. It does not follow from any of this, however, that the multiple sockets a browser uses in concurrent TLS connections to the same server use the same Session keys. A vendor used WireShark to monitor suc – Mr. Mxyxptlik Dec 5 '18 at 19:38
  • Through 1.2 even when the session, and its master secret, is reused, the working key values (plural, 2-6 of them) for each connection are different; see e.g. crypto.stackexchange.com/questions/50799/… and links there, including my comment about resumption. For 1.3 there is no resumption as such, instead you can label and use a derived secret from the prior session as a 'PSK' either alone or with a new ephemeral exchange for a new session. – dave_thompson_085 Jan 5 at 6:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.