<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p class="details" style="font-style: italic; color: #666;">
<a href="https://gitlab.com/airtower-luna">Airtower</a> created an issue <a href="https://gitlab.com/gnutls/gnutls/-/issues/1097">#1097</a>:
</p>
<div></div>
<p dir="auto">The <a href="https://gnutls.org/manual/html_node/Session-resumption.html" rel="nofollow noreferrer noopener" target="_blank">documentation on session
resumption</a>
currently says this:</p>
<blockquote dir="auto">
<p>Those will be the initial keys, but GnuTLS will rotate them
regularly. [...] Every such interval, new keys will be generated
from those initial keys. This is a necessary mechanism to prevent
the keys from becoming long-term keys and as such preserve
forward-secrecy in the issued session tickets.</p>
</blockquote>
<p dir="auto">However, no <em>rotation</em>, only key derivation. The initial key is never
wiped and does in fact become a long term key. Someone who is able to
steal it from server memory can derive TOTP keys for any round they
want, and decrypt the associated tickets.</p>
<p dir="auto">I'm not sure how useful the rotation is at all with this limitation:
It doesn't protect against server memory compromise, but I don't know
if there could be any cryptanalysis attacks that would allow deriving
keys or other secrets after collecting many tickets encrypted with the
same key. In that case the TOTP key derivation would protect against
attackers on the network.</p>
<p dir="auto">The limitation should be made clear in the documentation, so people
with forward secrecy requirements stronger than "keys wiped during
server restart" will know to either disable tickets altogether or
implement their own rotation.</p>
<p dir="auto">Related to this, two functions are missing details in the API
documentation that are important when implementing a full rotation
that also replaces the initial key:</p>
<h3 dir="auto">
<a id="user-content-gnutls_session_ticket_key_generate" class="anchor" href="#gnutls_session_ticket_key_generate" aria-hidden="true"></a><code>gnutls_session_ticket_key_generate()</code>
</h3>
<p dir="auto">Looking at the code the size of the key in memory is strictly
fixed. There is however no mention of the size in the
documentation. Would it be acceptable to guarantee a fixed key size
during application runtime, that is, create one key, and it'll be safe
to assume that keys generated by the same process have the same size?
This would be helpful in cases like mod_gnutls, where the Apache HTTPD
is made up of multiple processes, which would have to use a common key
e.g. using shared memory.</p>
<h3 dir="auto">
<a id="user-content-gnutls_session_ticket_enable_server" class="anchor" href="#gnutls_session_ticket_enable_server" aria-hidden="true"></a><code>gnutls_session_ticket_enable_server()</code>
</h3>
<p dir="auto">When replacing the intial key it's obviously important to wipe and
<code>free()</code> the previous one as soon as possible. The current code copies
the initial key into the session structure during
<code>gnutls_session_ticket_enable_server()</code>. This should be documented as
API, so applications can wipe old keys as soon as all calls to
<code>gnutls_session_ticket_enable_server()</code> that may have referenced the
old key have completed.</p>
<p dir="auto">I'd be happy to update the documentation if those things can be relied
on as API.</p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1097">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/a79475422242830796358ca22099f8a1/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1097"}}</script>
</p>
</div>
</body>
</html>