Skip to content

crypto/tls: allow omitting certificates from session ticket #77379

Description

@FiloSottile

In order to do chain revalidation (#77217) and to populate ConnectionState, we store the peer certificates and verified chains in the session ticket, so they will be available to the resumed connection.

@marten-seemann points out that this makes TLS 1.3 resumption nearly useless, because it doesn't save round-trips and the client sends a ticket which is as large as the original chain (or larger, if it includes verified chains that include the root and potentially duplicate the intermediate).

@espadolini suggested a new ClientAuth value that lets servers opt in to not including the certificates in the ticket.

An alternative is a method on SessionState that removes the certificates, which applications would then use with WrapSession. I like this because it makes it easy for applications to save some information from the certificate (in SessionState.Extra) while doing that.

This is only really a concern on the server side. On the client side we can assume that ClientSessionCache storage is abundant.

This would go along well with #77378.

/cc @golang/security

Metadata

Metadata

Assignees

No one assigned

    Labels

    LibraryProposalIssues describing a requested change to the Go standard library or x/ libraries, but not to a toolNeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions