Closed
Bug 1528666
Opened 7 years ago
Closed 6 years ago
Allow changing ciphersuite in TLS 1.3 resumption
Categories
(NSS :: Libraries, enhancement, P1)
NSS
Libraries
Tracking
(Not tracked)
RESOLVED
FIXED
3.46
People
(Reporter: mt, Assigned: mt)
Details
(Whiteboard: [tls13])
Attachments
(1 file)
It turns out that we don't have tests that verify that 0-RTT and resumption are properly handled when ciphersuites change. So I wrote some. Then I discovered that we allow the ciphersuite to change to a compatible one (that is, one with a matching hash function), but we don't attempt resumption if the previous ciphersuite is disabled. That is relatively easy to do.
|
Assignee | |
Comment 1•7 years ago
|
||
We allowed resumption before, but it didn't work.
Note that I also tightened the version test. We test against the version of
the session, not the versions permitted by the client. This is because
resumption can't change the version.
|
||
Updated•6 years ago
|
Priority: -- → P1
Whiteboard: [tls13]
|
|
Assignee | |
Comment 2•6 years ago
|
||
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → 3.46
|
|
Assignee | |
Comment 3•6 years ago
|
||
You need to log in
before you can comment on or make changes to this bug.
Description
•