eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add mbedtls_ssl_ticket_rotate for ticket rotation.

Browse source 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
This commit is contained in:
Glenn Strauss 2022-02-02 23:32:18 -05:00
parent 196a1c4256
commit a950938ff0
3 changed files with 69 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

39
include/mbedtls/ssl_ticket.h
View file

@ -98,7 +98,7 @@ void mbedtls_ssl_ticket_init( mbedtls_ssl_ticket_context *ctx );
* supported. Usually that means a 256-bit key.
*
* \note The lifetime of the keys is twice the lifetime of tickets.
* It is recommended to pick a reasonnable lifetime so as not
* It is recommended to pick a reasonable lifetime so as not
* to negate the benefits of forward secrecy.
*
* \return 0 if successful,
@ -109,6 +109,43 @@ int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx,
mbedtls_cipher_type_t cipher,
uint32_t lifetime );
/**
* \brief Rotate session ticket encryption key to new specified key.
* Provides for external control of session ticket encryption
* key rotation, e.g. for synchronization between different
* machines. If this function is not used, or if not called
* before ticket lifetime expires, then a new session ticket
* encryption key is generated internally in order to avoid
* unbounded session ticket encryption key lifetimes.
*
* \param ctx Context to be set up
* \param name Session ticket encryption key name
* \param nlength Session ticket encryption key name length in bytes
* \param k Session ticket encryption key
* \param klength Session ticket encryption key length in bytes
* \param lifetime Tickets lifetime in seconds
* Recommended value: 86400 (one day).
*
* \note \c name and \c k are recommended to be cryptographically
* random data.
*
* \note \c nlength must match sizeof( ctx->name )
*
* \note \c klength must be sufficient for use by cipher specified
* to \c mbedtls_ssl_ticket_setup
*
* \note The lifetime of the keys is twice the lifetime of tickets.
* It is recommended to pick a reasonable lifetime so as not
* to negate the benefits of forward secrecy.
*
* \return 0 if successful,
* or a specific MBEDTLS_ERR_XXX error code
*/
int mbedtls_ssl_ticket_rotate( mbedtls_ssl_ticket_context *ctx,
const unsigned char *name, size_t nlength,
const unsigned char *k, size_t klength,
uint32_t lifetime );
/**
* \brief Implementation of the ticket write callback
*