oss-security - Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1423067744.65358.223075205.4AE926CB@webmail.messagingengine.com>
Date: Wed, 04 Feb 2015 10:35:44 -0600
From: Mark Felder <feld@...d.me>
To: oss-security@...ts.openwall.com
Subject: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable?

>From the 2.4.12 changelog:

  *) mod_ssl: New directive SSLSessionTickets (On|Off).
     The directive controls the use of TLS session tickets (RFC 5077),
     default value is "On" (unchanged behavior).
     Session ticket creation uses a random key created during web
     server startup and recreated during restarts. No other key
     recreation mechanism is available currently. Therefore using
     session
     tickets without restarting the web server with an appropriate
     frequency
     (e.g. daily) compromises perfect forward secrecy. [Rainer Jung]

So if you use Apache 2.4 and care about PFS protecting your data, you
should turn this feature off. This appears to be an implementation issue
because there is no other way for Apache to recreate keys. I don't know
a lot about the fine details of Session Tickets, but can anyone care to
comment if there are other known bad implementations of session tickets
out there? Does this affect Apache 2.2? Nginx? Lighttpd?

Thanks

I find this bizarre that a known security weakness like this is left
"on" by default...

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.