Subject: [TLS] Stateless TLS Session Resumption extension and EAP-FAST.

From: Jan Nordqvist <[email-masked]>
Date: Thu, 01 Mar 2007 11:51:41 -0800

I apologize if this gets duplicated, I had the wrong address registered:

During some recent work incorporating EAP-FAST support into our TLS
stack I have discovered that the devices we use for testing are
violating the format of the stateless session ticket extension
definition per RFC-4507. In all instances I have seen, the whole
SessionTicket is preceded by a two-byte 'type' field, i.e. the
definition is really

struct {
    uint16 type;
    opaque ticket<0..2^16-1>;
} SessionTicket;

I don't know the size of deployments of EAP-FAST devices versus other
implementations using the session ticket extension, but it seems that
either RFC-4507 needs to be updated to reflect what is actually
implemented or perhaps the extension should be split into two.

Regards,
Jan Nordqvist

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Mon, 5 Mar 2007 14:18:19 -0800

Hi Jan,

You are correct, there is an issue with current implementation.  Thanks
for pointing this out.  Details follow:

Current EAP-FAST implementations do not format the extension correctly
as to spec.  They leave out one of the length fields.

EAP-FAST implementation:

      struct {
  	   uint16 extensionType 	
 	   opaque ticket<0..2^16-1>
      } SessionTicketExtension

Example encoding: 00 23 LL LL TT TT TT ...

LL - ticket length
TT - ticket

RFC4507:

>  	   uint16 extensionType 	
> 	   opaque SessionTicket<0..2^16-1>
>    } SessionTicketExtension
>

Example encoding: 00 23 LN LN LL LL TT TT TT....

LN - length of ticket + 2-bytes

Joe 

> -----Original Message-----
> From: Jan Nordqvist [mailto:[email-masked]] 
> Sent: Thursday, March 01, 2007 11:52 AM
> To: [email-masked]
> Subject: [TLS] Stateless TLS Session Resumption extension and 
> EAP-FAST.
> 
> During some recent work incorporating EAP-FAST support into 
> our TLS stack I have discovered that the devices we use for 
> testing are violating the format of the stateless session 
> ticket extension definition per RFC-4507. In all instances I 
> have seen, the whole SessionTicket is preceded by a two-byte 
> 'type' field, i.e. the definition is really
> 
> struct {
>     uint16 type;
> I don't know the size of deployments of EAP-FAST devices 
> versus other implementations using the session ticket 
> extension, but it seems that either RFC-4507 needs to be 
> updated to reflect what is actually implemented or perhaps 
> the extension should be split into two.
> 
> Regards,
> Jan Nordqvist
> 
>