crypto/tls: TLS 1.3 ticket_age_add accepts partial random reads

[jvdprng]

Description

TLS 1.3 session-ticket generation uses a single Read call to fill the four-byte ticket_age_add field and checks only the returned error. A custom Config.Rand can legally return a short read with a nil error, leaving part of the value as zero bytes.

This does not expose key material. The impact is limited to weakening ticket-age obfuscation when an application configures a short-reading random source.

Specification

RFC 8446 Section 4.6.1 defines ticket_age_add as a securely generated random 32-bit value generated by the server.

Code references

• go/src/crypto/tls/handshake_server_tls13.go:1006 notes the RFC 8446 requirement.
• go/src/crypto/tls/handshake_server_tls13.go:1009 allocates the four-byte buffer.
• go/src/crypto/tls/handshake_server_tls13.go:1010 calls Read once and does not check whether all four bytes were filled.
• go/src/crypto/tls/handshake_server_tls13.go:1013 serializes the possibly partially initialized value.

Test case

This is best as a Go unit test using a custom Config.Rand that returns one byte per successful read. The test should assert that session-ticket generation uses io.ReadFull-style behavior and consumes exactly four bytes or returns an error.

[thepudds]

Hi @jvdprng, I noticed that you filled a decent number number of issues here in a short period of time.

It would be best if you could follow the issue template, and ideally include a standalone reproducer. A complete runnable program is good. A link on go.dev/play is best. Thanks.

[gabyhelp]

Related Issues

• crypto/tls: randomly generate ticket_age_add [freeze exception] #52814 (closed)
• crypto/tls: SetSessionTicketKeys can race with automatic ticket-key rotation state #79862
• crypto/tls: randomly generate ticket_age_add #52850 (closed)
• crypto/tls: TLS 1.3 post-handshake messages can bypass non-advancing record limit #79866
• crypto/tls: reject TLS 1.3 empty NewSessionTicket messages #70513 (closed)
• crypto/tls: automatically rotated ticket keys are valid for longer than documented #77309

Related Code Changes

• crypto/tls: randomly generate ticket_age_add

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jvdprng]

Hi @thepudds, apologies for not using the template! In my defense, I coordinated with @rolandshoemaker in advance and he said a straightforward description was fine.

I'll try to add the reproducers, but for some issues it might be cumbersome (especially the race condition one).

[jvdprng]

I was requested to tag @golang/security but I just want to test whether that works

[thepudds]

I coordinated with @rolandshoemaker in advance and he said a straightforward description was fine.

Hi @jvdprng, that makes sense, especially given you are already coordinating Roland. Thanks!

[jvdprng]

Playground reproducer: https://go.dev/play/p/tZX9mDDupPE

[cherrymui]

cc @golang/security