Don't send session tickets when client authentication is being used
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 640
- Forks
- 173
- Avg merge
- 22h 14m
- Merged PRs (30d)
- 3
Description
Two issues:
- the ticket is never used, because resumption and client authentication are mutually exclusive features in picotls
- the handshake transcript used for generating the ticket is in correct, because we send the ticket along with ServerFinished under the assumption that the only yet-to-be-seen messages are EOED and CF
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the handshake path that issues session tickets when client authentication is enabled, focusing on the ServerFinished, EOED, and CF messages named in the issue. Check how the handshake transcript is captured for ticket generation. Done means client-authenticated handshakes do not send unused tickets and ticket generation does not use an incomplete transcript.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100