[gnutls-devel] GnuTLS | borinssl early data is rejected by gnutls server because of the ticket age (#1403)

[Read-only notification of GnuTLS library development activities]

Tatsuhiro Tsujikawa created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1403



## Description of problem:

I often observed that boringssl early data got rejected by gnutls server due to ticket age:

> gnutls[3]: ASSERT: tls13/anti_replay.c[_gnutls_anti_replay_check]:152
> gnutls[4]: EXT[0x...]: replay detected; rejecting early data

That is https://gitlab.com/gnutls/gnutls/-/blob/84546da2c30d84a7aaeaf82af1f6d0b101b54d81/lib/tls13/anti_replay.c#L147-151

```c
	/* It shouldn't be possible that the server's view of ticket
	 * age is smaller than the client's view.
	 */
```

Whey does this happen?  Because boringssl drops sub-second when calculating obfuscated_ticket_age:

https://boringssl.googlesource.com/boringssl/+/refs/heads/master/ssl/extensions.cc#1982

It looks like RFC 8446 only says that "a server MUST validate
that the ticket age for the selected PSK identity ... is within a small tolerance of the time since the ticket
was issued".  This particular check done by gnutls might be too strict.


## Version of gnutls used:

master branch

## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)


## How reproducible:

Send early data from boringssl client to gnutls server.
Do this several times and see the early data rejection by gnutls server.

## Actual results:

Early data from boringssl client is often rejected.

## Expected results:

Early data from boringssl client should be accepted if the ticket age is within the acceptable range.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1403
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20220913/8323f63d/attachment.html>