,
9 tweets,
2 min read
Read on Twitter
We need to talk about TLS 1.2 Session Tickets and how they are the weakest link in modern TLS deployments. blog.filippo.io/we-need-to-tal…
Session Tickets are a way to speed up TLS handshakes in resumed connections. They work by keeping encrypted session keys with the client. 2/ 
The problem is that in 1.2 there's no (EC)DH involved, so an attacker that obtains the Ticket key can passively decrypt traffic w/o PFS. 3/
Now that would only allow passive monitoring of resumed connections, but unfortunately Tickets contain the ORIGINAL connection's keys. 4/
But the attacker would still need to catch a resumption... if TLS 1.2 didn't send the Tickets with the original connection IN THE CLEAR. 5/
I can't figure out why that is, but it means that all connections that merely support TLS 1.2 Session Tickets are vulnerable (╯°□°)╯︵ ┻━┻ 6/
And unfortunately some networks reuse the same Ticket encryption key for a long time or even across all machines! aaspring.com/imc2016/crypto… 7/
So an attacker that extracts a single key (per period) from a single machine in a single country can passively decrypt traffic globally. 8/
TLS 1.3 is a lot better but its deployment is stalled. 🙄 In the meantime, 1.2 Tickets are the weakest link against dragnet surveillance. 9/x
