3 ms·

Thanks, I must have misread the post: > "The issue applies to TLS 1.3, when using TLS 1.2 resumption fails as expected. Because the ticket can be used for resu

Thanks, I must have misread the post: > "The issue applies to TLS 1.3, when using TLS 1.2 resumption fails as expected. Because the ticket can be used for resumption without knowledge of the master key I assume (but haven't tested yet) that it can also be used for passive decryption of early data." I assumed that the server was using a ticket generated using TLS 1.2 to somehow resume a TLS 1.3 connection.

agwa 6y ago
The bug report downplays the severity of the problem. This comment comes the closest to explaining the severity: > ticket encryption key and decryption key are all-zero [...] in TLS 1.2, it may allow attackers to recover the previous conversations https://gitlab.com/gnutls/gnutls/-/issues/1011#note_353830633 https://gitlab.com/gnutls/gnutls/-/issues/1011#note_35383063...