Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS 1.3 Session Resumption with PSKs in pyopenssl? #1291

Closed
dennisn00 opened this issue Jan 30, 2024 · 1 comment
Closed

TLS 1.3 Session Resumption with PSKs in pyopenssl? #1291

dennisn00 opened this issue Jan 30, 2024 · 1 comment

Comments

@dennisn00
Copy link

I am trying to build mTLS client and server with pyopenssl and measure timing for the handshake to compare to some alternative approach.
I want to test performance for the handshake with and without Session Resumption. In TLS 1.3, the server may send a New Session Ticket Message containing a PSK Identity that the Client can use on subsequent connections to resume the session.
It seems like some necessary Bindings were added to cryptography here but I couldn't find any relating functions in pyopenssl.
Is there a way to use Session Resumption with PSKs in pyopenssl or is there any plans to implement this feature?

@dennisn00
Copy link
Author

I figured out that this is indeed possible with pyOpenSSL, with the standard mechanism described below. I assume OpenSSL is handling the details of the implementation internally.
On the server side, I used

 context.set_session_cache_mode(SSL.SESS_CACHE_SERVER)
 context.set_session_id(b"test")

and on the client side

context.set_session_cache_mode(SSL.SESS_CACHE_CLIENT)
session = None
...
ssl_connection.connect(endpoint)
if session:
    ssl_connection.set_session(session)
ssl_connection.do_handshake()
data = ssl_connection.recv(1)
if data:
    session = ssl_connection.get_session()

My problem was that previously, I saved the session right after the handshake before receiving any data.
This meant that no Session Ticket was received yet and thus the session could not be reused.
The New Session Ticket Message is sent before the first application data, so when the first byte of data arrives I can store the session for reuse.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 17, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

No branches or pull requests

1 participant