3

How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the more insecure it becomes.

I have read about renegotiation (which is deprecated in TLS 1.3), session tickets and session resumption, but I'm not sure how these are utilised in practice concerning my question.

If I want to change the key used for encryption for example every day with OpenSSL implementation, do I have to manually close the connection and initiate a session resumption every day, or is there something which automatically does something like this?

  • I've migrated here because the question seems more about general security properties of TLS than the cryptography that is involved. Generally, if a question included "in practice" it might be a good idea to check if our beloved sister site is a better place than cryptography for it. – Maarten Bodewes Oct 31 at 15:14
  • 2
    It will use key updates/rekeying. See the RFC if someone wants to write an answer up with it. – user Oct 31 at 17:01
  • Note 1.3 also eliminates session resumption (using same master) and real tickets; it repurposes the ticket message to only name a secret derived from (but not reversible to) one session as PSK for a subsequent session. – dave_thompson_085 Nov 1 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.