How does TLS 1.3 handle communication between the server and the client where it can last for a very long time (like years), without any pause in it? My concern is that the longer a key is used the more insecure it becomes.

I have read about renegotiation (which is deprecated in TLS 1.3), session tickets and session resumption, but I'm not sure how these are utilised in practice concerning my question.

If I want to change the key used for encryption for example every day with OpenSSL implementation, do I have to manually close the connection and initiate a session resumption every day, or is there something which automatically does something like this?

  • I've migrated here because the question seems more about general security properties of TLS than the cryptography that is involved. Generally, if a question included "in practice" it might be a good idea to check if our beloved sister site is a better place than cryptography for it. Oct 31, 2019 at 15:14
  • 2
    It will use key updates/rekeying. See the RFC if someone wants to write an answer up with it.
    – user
    Oct 31, 2019 at 17:01
  • Note 1.3 also eliminates session resumption (using same master) and real tickets; it repurposes the ticket message to only name a secret derived from (but not reversible to) one session as PSK for a subsequent session. Nov 1, 2019 at 3:24


You must log in to answer this question.

Browse other questions tagged .