On Fri, Mar 28, 2014 at 07:21:08PM +0000, Viktor Dukhovni wrote:
> Postfix rotates session ticket keys. It currently uses AES-128
> for the bulk encryption, but this is easy to change. I could easily
> make it configurable. (Will as soon as I get a chance).
Done, 2.12 will have configurable session ticket encryption, the
default is still aes-128-cbc, but the administrator can configure
aes-192-cbc, aes-256-cbc, or any other CBC block cipher with a
16-byte IV and key length between 128 and 256 bits.
I am not sure whether to leave the default at 128-bits or take the
opportunity to switch to aes-256-cbc by default, the added cost
seems marginal, especially when traffic payload is often encrypted
at 256-bits.
> By the way, RFC 5077 specifies a 256-bit HMAC key for session
> tickets, but OpenSSL seems to by default use as 128-bit HMAC key.
> Is this deliberate?
>
> ssl/s3_lib.c:
> if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
> {
> memcpy(ctx->tlsext_tick_key_name, keys, 16);
> memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
> memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
> }
This looks like an RFC 4507 vs. 5077 difference. Not sure whether
it is worth the trouble to change the control API to allow users
to set keys with a 32-bit HMAC key, or why the HMAC key should be
stronger than the bulk crypto key. This limitation does not impact
applications that use the ticket_cb, which do their own session
ticket key management.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [email protected]
Automated List Manager [email protected]
