In order to rotate session ticket keys effectively, it is useful for the TLS server implementation to support accepting connections with tickets encrypted with previous key(s). Currently the server supports a single session ticket key, and it is not easy to rotate the key. Also, the server cannot be configured to accept tickets encrypted with old keys.
One solution to this is to add two optional fields to *tls.Config:
// GetSessionTicketKey returns the current session ticket key.
GetSessionTicketKey func(*ClientHelloInfo) ([32]byte, error)
// AllowPreviousSessionTicketKeys specifies the number of previous
// unique session ticket keys retrieved from GetSessionTicketKey that
// will be used to accept session tickets.
AllowPreviousSessionTicketKeys int
This way the server could cache n previous keys and when a session ticket using an old key is encountered it would send a new session ticket encrypted with the current key.
This is certainly not the only approach that could be taken, just a strawman proposal to start discussion.
/cc @agl
In order to rotate session ticket keys effectively, it is useful for the TLS server implementation to support accepting connections with tickets encrypted with previous key(s). Currently the server supports a single session ticket key, and it is not easy to rotate the key. Also, the server cannot be configured to accept tickets encrypted with old keys.
One solution to this is to add two optional fields to
*tls.Config:This way the server could cache n previous keys and when a session ticket using an old key is encountered it would send a new session ticket encrypted with the current key.
This is certainly not the only approach that could be taken, just a strawman proposal to start discussion.
/cc @agl