Subject: [TLS] Tickets after key update/post handshake auth

From: Matt Caswell <[email-masked]>
Date: Fri, 16 Mar 2018 16:19:49 +0000

What is reasonable behaviour for a client to do with any tickets it has
previously received following a key update or a post-handshake
authentication? Should those old tickets be now considered out-of-date
and not used?

Matt

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 16 Mar 2018 16:36:25 +0000

> authentication? Should those old tickets be now considered out-of-date

There is no good reason to discard tickets received post KeyUpdate. The
KeyUpdate
has no impact on their security.

It's probably reasonable to discard tickets received after Post-Handshake
Auth if a new
ticket is received, as that ticket might incorporate the client's
authenticated identity. Otherwise
I wouldn't bother.

-Ekr

> Matt
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Hubert Kario <[email-masked]>
Date: Fri, 16 Mar 2018 17:46:20 +0100

> authentication? Should those old tickets be now considered out-of-date

as far as I can tell KeyUpdate does affect only `application traffic secret`, 
not `resumption master secret` so the tickets should be kept in this case, 
they'd generate the same PSK resumption secret anyway (all else being equal)

regarding authentication:
Section E.1.2:
   If the client needs to determine if the server considers the
   connection to be unilaterally or mutually authenticated, this has to
   be provisioned by the application layer.
so it doesn't look like it should affect what TLS implementation does.
(I mean, I don't see anything related to recalculation of the secrets and 
encryption keys post-authentication)
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: Martin Thomson <[email-masked]>
Date: Fri, 16 Mar 2018 16:53:46 +0000

That's only because there is some chance that the ticket binds in more
contextual information.  In practice, this might also happen as a
result of application-layer changes.  At the TLS layer, it's hard to
know exactly why the new ticket was issued.  If it was just adding
another ticket to the pile of available tickets, or whether it
replaced previous tickets.  As the consequences of using an invalid
ticket aren't serious, I would suggest that you simply use the most
recent one.  If you only use each ticket once, then use the most
recent one and hope that it's still current.

As ekr says, the old ticket isn't invalid from the perspective of TLS.
That only happens at the expiration time, and as the server decides.
You know the former, and can only guess at the latter.