How to botch TLS forward secrecy

Re:How to botch TLS forward secrecy by marshray on Thursday June 27, 2013 @11:25PM (#5956023)

Perhaps someone ought to add session ticket support to OpenSSL for using some of the latest fast in memory-only databases.

If I were a company which made such a database, I'd think that kind of project would give me very good exposure.

[ Parent | on HN ]

Re:How to botch TLS forward secrecy by lifeisstillgood on Friday June 28, 2013 @02:54AM (#5956667)

I think there are two takeaways from this

1. A timely reminder nothing is perfectly secure

2. Don't use session tickets. Store nothing on the client except a random key. You will cock it up.

[ Parent | on HN ]

Re:How to botch TLS forward secrecy by stass on Friday June 28, 2013 @12:07AM (#5956170)

OpenSSL itself does not deal with tickets, afaik. The application code does.

[ Parent | on HN ]