Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

handle AES and HMAC operations #6

Open
kazuho opened this issue Sep 25, 2015 · 0 comments
Open

handle AES and HMAC operations #6

kazuho opened this issue Sep 25, 2015 · 0 comments

Comments

@kazuho
Copy link
Member

kazuho commented Sep 25, 2015

In case of TLS, keys used to encrypt session tickets is also a long-term secret that needs to be taken care in addition to RSA private keys (note :in H2O we rotate the session ticket keys periodically, but not all web servers do it; see http://blog.kazuhooku.com/2015/07/h2o-version-140-released-with.html).

With OpenSSL it is possible add user-defined symmetric ciphers / HMACs at run-time, so it is theoretically possible to create them that uses IPC so that their secrets will be protected in conjunction with the RSA private keys.

The downside is that due to how OpenSSL is designed, it would cause two IPC calls for every ticket-based session resumption.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant