3
$\begingroup$

In the following link it says:

When a 1.3 client connects to a 1.3 server they agree on a resumption key (or PSK, pre-shared key), and the server gives the client a Session Ticket that will help it remember it. The Ticket can be an encrypted copy of the PSK—to avoid state—or a reference number."

https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/

I have read through the draft of TLS 1.3 and have only found that a Client sends an PSK-identifier, which is a number, that belongs uniquely to a PSK. I couldn't find any mention of "an encrypted copy of the PSK".

Am I wrong? Did I miss something in the draft? Because if I did not miss anything, servers would need to keep state of every PSK they have established, no?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ It is up to the implementation how to map the identifier to the actual key. However it is common to use a stateless approach. This have been used in former versions with session tickets as described in RFC 5077. $\endgroup$
    – eckes
    Dec 9, 2017 at 5:06

1 Answer 1

Reset to default
2
$\begingroup$

PSK is encrypted and normally sent after finished message. If you inspect with wireshark, it appears as application data. If you decrypt this message, you will find the session ticket including the psk id.

Servers can use psk id for stateless approach. Servers can encrypt the resumption psk, issue time, and so on.. and use this encrypted message as a psk id. When the client present psk id, server can fetch those informations to resume by decrypting it.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.