Session tickets in TLS and possible security flaws

Here is an interesting post about session tickets in TLS 1.2 and possible security flaws. The author describes how session resumption works in TLS 1.2, and then discuss three possible flaws in this mechanism. He also mentions how the issues are going to be addressed in TLS 1.3

Enjoy!

WE NEED TO TALK ABOUT SESSION TICKETS

Starting TLS 1.3 server with OpenSSL

At the moment TLSv13 specification is still a draft. But OpenSSL already supports TLSv13. According to this blog post, OpenSSL git master branch contains our development TLS 1.3 code which can be used for testing purposes.

Here are steps how to build OpenSSL with TLS 1.3, and run a local server for testing.