In the following link it says:

When a 1.3 client connects to a 1.3 server they agree on a resumption key (or PSK, pre-shared key), and the server gives the client a Session Ticket that will help it remember it. The Ticket can be an encrypted copy of the PSK—to avoid state—or a reference number."


I have read through the draft of TLS 1.3 and have only found that a Client sends an PSK-identifier, which is a number, that belongs uniquely to a PSK. I couldn't find any mention of "an encrypted copy of the PSK".

Am I wrong? Did I miss something in the draft? Because if I did not miss anything, servers would need to keep state of every PSK they have established, no?

  • $\begingroup$ It is up to the implementation how to map the identifier to the actual key. However it is common to use a stateless approach. This have been used in former versions with session tickets as described in RFC 5077. $\endgroup$ – eckes Dec 9 '17 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.