I am learning TLS Session Resumption.

What I got is session resumption can reduce 1 RTT for TLS 1.2 by reusing MasterSecret. Both the client and server needn't to run key exchange algorithm.

My questions are:

  1. Whether session resumption reuses symmetric encryption keys (to encrypt TLS records).
  2. What factors affect whether to reuse symmetric encryption keys?

I searched around Google, but cannot find a authoritative answer. Here is what I got:

  1. Do not reuse encryption keys. Refer to SSL session key usage when browser opens multiple sockets to same server and https://wiki.openssl.org/index.php/SSL_and_TLS_Protocols#Session_Resumption
  2. Reuse encryption keys. Refer to https://www.venafi.com/blog/tls-session-resumption. That link writes Client and server store this session ID along with the session keys and connection states.

Any ideas are welcome.

  • 1
    The first link is is not about reuse of encryption key on session reuse - it is about reusing the session in the first place. If the same encryption keys are used if a session is resumed is a different question. – Steffen Ullrich Jan 11 at 13:06
  • @SteffenUllrich By the first link, I mean the comment pasted by user "dave_thompson_085" – Zachary Jan 11 at 13:09
  • @SteffenUllrich Thanks for the feedback. I pasted the wrong link but I lost the link reference that tells to "reuse encryption keys". Anyway, you can ignore the ref link. My question whether to reuse or not and what factors decide whether too reuse or not. – Zachary Jan 11 at 13:43

TL;DR: Secrets are reused, but encryption keys are not reused.

With TLS 1.2 and lower the master secret was reused though and the encryption keys were derived from this. But this key derivation includes connection specific random data, so the keys are specific for the connection and not for all reuses of the same session. Knowledge of master secret (for example due to an information leak like in Heartbleed) and sniffing of traffic allowed the recreation of the encryption keys though, and thus reusing the same session for too long might impact forward secrecy.

With TLS 1.3 session resumptions works completely different. Basically it just replaces the certificate based authentication with a smaller and faster PSK based authentication (with a previously shared secret), but the key exchange works as with a "full" handshake. Thus not even the master secret is reused and forward secrecy is not impacted.

  • So the conclusion also applies to TLS 1.3? I mean "only secret is reused; encryption keys are not". – Zachary Jan 11 at 14:30
  • @Zachary: Yes, the TL;DR applies to all versions of TLS, including TLS 1.3. – Steffen Ullrich Jan 11 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.