Subject: Re: [Uta] Fwd: I-D Action: draft-saintandre-xmpp-tls-03.txt

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 03 Feb 2014 09:45:19 -0700

My apologies for the slow reply...

On 12/17/13, 2:06 PM, Yaron Sheffer wrote:
> Hi Peter,
>
> One comment about the draft:
>
> Stateless session resumption (RFC 5077) lists AES128/SHA256 as the
> recommended algorithms for protecting the ticket. It does not "mandate"
> these algorithms, in my reading. And of course servers can change these
> algorithms unilaterally.
>
> For some reason the authors do not specify that this protection should
> be at the same strength as the TLS cipher suite. However they do mandate
> (as a SHOULD) that keys be changed regularly. If this is the case (e.g.
> if ticket keys are changed once a week), then the forward secrecy
> argument doesn't hold.
>
> Can we add something like:
>
> However, session tickets can be used if a stronger cipher suite is
> employed to encrypt the ticket (as least as strong as the main TLS
> cipher suite), and if ticket keys are changed regularly, e.g. once every
> week.

Yes, that makes sense. I found conflicting information about ticket 
protection when researching the topic, but RFC 5077 governs such things 
(not random information one can find on the Internet).

Perhaps it makes sense to move any text (or at least guidelines) about 
session resumption to the "TLS-BCP" document? I do think that different 
application protocols might have different requirements here, but some 
general guidelines would be useful.

Peter

--
Peter Saint-Andre
https://stpeter.im/