[openssl/openssl] 17bf6c: TLS 1.3: Suppress early_data on PSK ticket age mis...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 17bf6c48ea8a6af1cb90f2f2aab4bb4b9e2adfc5
      https://github.com/openssl/openssl/commit/17bf6c48ea8a6af1cb90f2f2aab4bb4b9e2adfc5
  Author: Daniel Kubec <[email protected]>
  Date:   2026-08-16 (Sun, 16 Aug 2026)

  Changed paths:
    M CHANGES.md
    M doc/man3/SSL_read_early_data.pod
    M ssl/record/rec_layer_s3.c
    M ssl/ssl_lib.c
    M ssl/ssl_local.h
    M ssl/statem/extensions.c
    M ssl/statem/extensions_clnt.c
    M ssl/statem/statem.c
    M ssl/tls13_enc.c
    M test/tls13tickettest.c

  Log Message:
  -----------
  TLS 1.3: Suppress early_data on PSK ticket age mismatch

tls13_check_psk() mirrors the gating checks in tls_construct_ctos_psk() so that
early_data is only advertised when the PSK will actually be sent. Normally we
stamp the state back to SSL_EARLY_DATA_CONNECT_RETRY so the next
SSL_write_early_data() call resumes here. However
tls_construct_ctos_early_data() may have reset early_data_state to
SSL_EARLY_DATA_NONE because it decided not to send the early_data extension.
In that case leave the state alone so the handshake can complete without 0-RTT.

- RFC 9846 4.3.10: When a PSK is used and early data is allowed for that PSK,
the client can send Application Data in its first flight of messages. If the
client opts to do so, it MUST supply both the "pre_shared_key" and
"early_data" extensions. The PSK used to encrypt the early data MUST be the
first PSK listed in the client's "pre_shared_key" extension.

- RFC 9846 4.3.11.1: Clients MUST NOT attempt to use tickets which have ages
greater than the "ticket_lifetime" value which was provided with the ticket.

- RFC 9846 4.3.10: For PSKs provisioned via NewSessionTicket, a server MUST
validate that the ticket age for the selected PSK identity is within a small
tolerance of the time since the ticket was issued. If it is not, the server
SHOULD proceed with the handshake but reject 0-RTT.

Fixes #13395

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Viktor Dukhovni <[email protected]>
MergeDate: Sun Aug 16 13:18:16 2026
(Merged from https://github.com/openssl/openssl/pull/32202)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/97a5ea-17bf6c%40github.com.