Enforce EMS during Session Resumption to prevent Triple Handshake Attacks
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
Problem:
Currently, OpenSSL (except in FIPS mode, ref: #19989) does not enforce EMS negotiation for compatibility reasons.
This means that when establishing a connection with a peer that does not support EMS, if session resumption and renegotiation are enabled, users are vulnerable to triple handshake attacks.
Proposed Solution
Change OpenSSL's behavior such that during session resumption, if the old session was negotiated without EMS, refuse to resume that session—instead require a new full handshake. This way, connections with peers that do not support EMS remain possible (for compatibility), but session resumption will not introduce triple handshake attack risk.
This improves security by preventing vulnerable session reuse without breaking compatibility with non-EMS peers.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing OpenSSL's session-resumption and EMS negotiation paths, then inspect how resumed sessions are validated and where related tests are kept. The work is done when sessions negotiated without EMS are refused during resumption, a full handshake is required instead, and compatibility with non-EMS peers remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100