Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 209.132.183.28 as permitted sender)
Date: Wed, 21 Aug 2013 12:17:28 +0100
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: TLS forward secrecy, session tickets and mod_ssl/OpenSSL
Message-ID: <20130821111727.GA7331@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
User-Agent: Mutt/1.5.21 (2010-09-15)
Organization: Registered in England and Wales under Company Registration No.
 03798903
  Directors: Michael Cunningham (USA), Mark Hegarty (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

Florent Daigniere presented on this at Black Hat.

Paper: https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf‎
Slides: https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf

Short Summary: Use of session tickets (enabled by default in OpenSSL) 
reduces effectiveness of TLS forward secrecy, because the keys used to 
generate tickets survive for the lifetime of the httpd process.  So if 
you have access to the httpd process you can retrieve the keys used to 
generate session tickets.

I can't see we can or should do much here other than adding an option 
(yay) which globally disables session ticket, SSL_OP_NO_TICKET in the 
SSL_CTX, for the paranoid.
	
It would be desirable (perhaps) if we could rotate keys faster than once 
the server lifetime, but this is shared state across the server so that 
is definitely non-trivial.

Any opinions here?

Regards, Joe