4

Is there any other difference except the session cache?

Will only Session ID based Session Resumption update symmetric TLS session key ?

Devang Kubavat
  • 115
  • 2
  • 11
  • 1
    I recommend the ["Session Resumption" section](https://hpbn.co/transport-layer-security-tls/#tls-session-resumption) of the "High Performance Browser Networking" book by Ilya Grigorik. – StackzOfZtuff Jan 03 '17 at 08:16
  • Thanks @StackzOfZtuff, I want to know about, Will only session ID based session resumption update symmetric TLS session key ?, "High Performance Browser Networking" book didn't talk about that. – Devang Kubavat Jan 03 '17 at 08:21
  • I think NEITHER of the schemes will do that. (But I don't have a good source.) What makes you think otherwise? – StackzOfZtuff Jan 03 '17 at 08:56
  • Have you sample code in which session ID based Session resumption is used ? I want deep understanding of the both methods...? according to memory constrain as well as security parameters. @StackzOfZtuff – Devang Kubavat Jan 03 '17 at 09:13

1 Answers1

5

Update: Warning: my understanding of this is botchy. See Dave Thompson’s comment.

——————————————

Will only Session ID based Session Resumption update symmetric TLS session key ?

Neither method will do that.

To quote Adam Langley: (line breaks mine)

TLS offers two session resumption mechanisms: session IDs (where the server and client each store their own secret state) and session tickets (where the client stores the server's state, encrypted by the server).

If an attacker can obtain the session resumption information for a connection then they can decrypt the connection.

(This needn't be completely true, but it is for TLS because of the way that TLS is designed.)

Source: How to botch TLS forward secrecy (27 Jun 2013) (Archived here.)

Further reading

Community
  • 1
StackzOfZtuff
  • 17,783
  • 1
  • 50
  • 86
  • Thanks. But, still i have lots of question regarding to TLS Session Resumption. i will go through it first... Thanks for support. @StackzOfZtuff – Devang Kubavat Jan 03 '17 at 12:41
  • 1
    @DevangKubavat: See also section 2.2 in this PDF: https://dl.acm.org/citation.cfm?id=2987480 – StackzOfZtuff Jan 04 '17 at 13:50
  • Yes, @StackzOfZtuff. After session resume, It is not updated Session key.. Same Previous session key is used in both the methods as per the paper. – Devang Kubavat Jan 05 '17 at 06:33
  • http://security.stackexchange.com/questions/147322/session-ticket-based-session-resumption. posted new question.Can u give me answer if you have an idea.. @StackzOfZtuff – Devang Kubavat Jan 05 '17 at 09:45
  • @DevangKubavat: Sorry. I have never done openssl programming. – StackzOfZtuff Jan 05 '17 at 10:00
  • Okay... Thank you! @StackzOfZruff. I have one conceptual question, What happens if attacker got the session ticket ? Attacker can try to reconnect to server. How Server will come to know that THIS IS NOT CORRECT CLIENT.? – Devang Kubavat Jan 05 '17 at 10:32
  • @DevangKubavat: Not at all. – StackzOfZtuff Jan 05 '17 at 14:49
  • 2
    To be exact, the _master secret_ is reused; the actual keys, plural (at least 2, often 4) are re-derived with new nonces, which does help with things like sweet32 and RC4 bias (or did before 3DES and RC4 were obsoleted), but (as you describe) does not provide forward secrecy. – dave_thompson_085 Apr 05 '18 at 05:42