<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"><head><!--[if gte mso 9]><xml><o:OfficeDocumentSettings><o:AllowPNG/><o:PixelsPerInch>96</o:PixelsPerInch></o:OfficeDocumentSettings></xml><![endif]--></head><body>
<span style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 13px; -webkit-text-size-adjust: auto; color: rgb(113, 95, 250);">Hi All,</span><br><blockquote class="iosymail"><div id="yiv4510926390"><div class="yiv4510926390yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div><div><br></div><div>I am in process of using TLS1.3 using openssl 1.1.1b version in my client application. In order to use session resumption, I have implemented an external cache when acting as the client. The key to the cache is combination of host and port and the value associated is SSL_SESSION*. Before calling ssl_connect, I am checking if the entry corresponding to the key exists in the map. If it exists, I am calling SSL_set_session. After ssl_connect, I am checking if the session is reused or not using SSL_Session_Reused. If its not reused, I am inserting the new session obtained as a result of call to SSL_get1_session() in the map.</div><div><br></div><div>Pseudo code is as follows:</div><div><br></div><div>std::map<std::string, SSL_SESSION*> sessionCache;</div><div>/* Generate an SSL client context. */</div><div>SSL_CTX* ctx = SSL_CTX_new(TLS_method());</div><div>SSL* ssl = SSL_new(ctx);</div><div> </div><div>//Check if we have a stored session </div><div>it = sessionCache.find (key);</div><div>if (it != sessionCache.end()) </div><div>{</div><div><span style="white-space:pre-wrap;"> </span>SSL_set_session (ssl, it->second)</div><div>}</div><div><br></div><div>SSL_connect(ssl);</div><div>int reUsed = SSL_session_reused(ssl);</div><div>if (!reUsed) {</div><div><span style="white-space:pre-wrap;"> </span>session = SSL_get1_session(ssl);</div><div><span style="white-space:pre-wrap;"> </span>sessionCache.insert (key, session);</div><div>}</div><div><br></div><div>The above flow works well using TLS1.2. I can see that SSL_session_reused returns true in the second connection. </div><div><br></div><div>But the same flow does not work for TLS1.3. In TLSv1.3, sessions are established after the main handshake has completed. So, I have implemented the callback SSL_CTX_sess_set_new_cb. And in the callback, I am storing the session into the cache. In subsequent connections, the session is present in the map, SSL_set_session API returns true. But SSL_session_reused is always returning false.</div><div><br></div><div>I have the following queries:</div><div>1. Is the above mentioned approach applicable for TLS 1.3? </div><div>2. There is a mention that PreShared keys are used for session resumption in TLS1.3. Can someone please clarify, how should I make my client send psk using openssl for subsequent connection?</div></div><br></div></div><blockquote></blockquote></blockquote>
</body></html>