ssl_ticket.h
mbedtls/private_access.h
mbedtls/build_info.h
mbedtls/ssl.h
mbedtls/cipher.h
mbedtls/platform_time.h
mbedtls/threading.h
mbedtls/asn1.h
mbedtls/bignum.h
mbedtls/build_info.h
mbedtls/ccm.h
mbedtls/chacha20.h
mbedtls/chachapoly.h
mbedtls/check_config.h
mbedtls/cipher.h
mbedtls/cmac.h
mbedtls/config_adjust_legacy_crypto.h
mbedtls/config_adjust_psa_from_legacy.h
mbedtls/config_adjust_psa_superset_legacy.h
mbedtls/config_adjust_ssl.h
mbedtls/config_adjust_x509.h
mbedtls/config_psa.h
mbedtls/dhm.h
mbedtls/ecdh.h
mbedtls/ecdsa.h
mbedtls/ecjpake.h
mbedtls/ecp.h
mbedtls/gcm.h
mbedtls/mbedtls_config.h
mbedtls/md.h
mbedtls/md5.h
mbedtls/pk.h
mbedtls/platform_time.h
mbedtls/platform_util.h
mbedtls/poly1305.h
mbedtls/private_access.h
mbedtls/ripemd160.h
mbedtls/rsa.h
mbedtls/sha1.h
mbedtls/sha256.h
mbedtls/sha3.h
mbedtls/sha512.h
mbedtls/ssl.h
mbedtls/ssl_ciphersuites.h
ssl_ticket.h
mbedtls/threading.h
mbedtls/x509.h
mbedtls/x509_crl.h
mbedtls/x509_crt.h
psa/build_info.h
psa/crypto.h
psa/crypto_adjust_auto_enabled.h
psa/crypto_adjust_config_dependencies.h
psa/crypto_adjust_config_key_pair_types.h
psa/crypto_adjust_config_synonyms.h
psa/crypto_builtin_composites.h
psa/crypto_builtin_key_derivation.h
psa/crypto_builtin_primitives.h
crypto_compat.h
psa/crypto_driver_common.h
psa/crypto_driver_contexts_composites.h
psa/crypto_driver_contexts_key_derivation.h
psa/crypto_driver_contexts_primitives.h
crypto_extra.h
psa/crypto_legacy.h
crypto_platform.h
crypto_sizes.h
crypto_struct.h
crypto_types.h
crypto_values.h
inttypes.h
limits.h
pthread.h
stddef.h
stdint.h
stdio.h
stdlib.h
time.h
mbedtls_ssl_ticket_key
mbedtls_ssl_ticket_context
MBEDTLS_SSL_TICKET_MAX_KEY_BYTES
32

Max supported key length in bytes

MBEDTLS_SSL_TICKET_KEY_NAME_BYTES
4

key name length in bytes

struct mbedtls_ssl_ticket_key typedef struct mbedtls_ssl_ticket_key mbedtls_ssl_ticket_key mbedtls_ssl_ticket_key

Information for session ticket protection.

struct mbedtls_ssl_ticket_context typedef struct mbedtls_ssl_ticket_context mbedtls_ssl_ticket_context mbedtls_ssl_ticket_context

Context for session ticket handling functions.

mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write mbedtls_ssl_ticket_write

Implementation of the ticket write callback.

See `mbedtls_ssl_ticket_write_t` for description

mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse mbedtls_ssl_ticket_parse

Implementation of the ticket parse callback.

See `mbedtls_ssl_ticket_parse_t` for description

void void mbedtls_ssl_ticket_init (mbedtls_ssl_ticket_context *ctx) mbedtls_ssl_ticket_init mbedtls_ssl_ticket_context * ctx

Initialize a ticket context. (Just make it ready for mbedtls_ssl_ticket_setup() or mbedtls_ssl_ticket_free().)

ctx

Context to be initialized

int int mbedtls_ssl_ticket_setup (mbedtls_ssl_ticket_context *ctx, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng, mbedtls_cipher_type_t cipher, uint32_t lifetime) mbedtls_ssl_ticket_setup mbedtls_ssl_ticket_context * ctx int(*)(void *, unsigned char *, size_t) f_rng void * p_rng mbedtls_cipher_type_t cipher uint32_t lifetime

Prepare context to be actually used.

ctx

Context to be set up

f_rng

RNG callback function (mandatory)

p_rng

RNG callback context

cipher

AEAD cipher to use for ticket protection. Recommended value: MBEDTLS_CIPHER_AES_256_GCM.

lifetime

Tickets lifetime in seconds Recommended value: 86400 (one day).

It is highly recommended to select a cipher that is at least as strong as the strongest ciphersuite supported. Usually that means a 256-bit key.

It is recommended to pick a reasonable lifetime so as not to negate the benefits of forward secrecy.

The TLS 1.3 specification states that ticket lifetime must be smaller than seven days. If ticket lifetime has been set to a value greater than seven days in this module then if the TLS 1.3 is configured to send tickets after the handshake it will fail the connection when trying to send the first ticket.

0 if successful, or a specific MBEDTLS_ERR_XXX error code

int int mbedtls_ssl_ticket_rotate (mbedtls_ssl_ticket_context *ctx, const unsigned char *name, size_t nlength, const unsigned char *k, size_t klength, uint32_t lifetime) mbedtls_ssl_ticket_rotate mbedtls_ssl_ticket_context * ctx const unsigned char * name size_t nlength const unsigned char * k size_t klength uint32_t lifetime

Rotate session ticket encryption key to new specified key. Provides for external control of session ticket encryption key rotation, e.g. for synchronization between different machines. If this function is not used, or if not called before ticket lifetime expires, then a new session ticket encryption key is generated internally in order to avoid unbounded session ticket encryption key lifetimes.

ctx

Context to be set up

name

Session ticket encryption key name

nlength

Session ticket encryption key name length in bytes

k

Session ticket encryption key

klength

Session ticket encryption key length in bytes

lifetime

Tickets lifetime in seconds Recommended value: 86400 (one day).

`name` and `k` are recommended to be cryptographically random data.

`nlength` must match sizeof( ctx->name )

`klength` must be sufficient for use by cipher specified to `mbedtls_ssl_ticket_setup`

It is recommended to pick a reasonable lifetime so as not to negate the benefits of forward secrecy.

The TLS 1.3 specification states that ticket lifetime must be smaller than seven days. If ticket lifetime has been set to a value greater than seven days in this module then if the TLS 1.3 is configured to send tickets after the handshake it will fail the connection when trying to send the first ticket.

0 if successful, or a specific MBEDTLS_ERR_XXX error code

void void mbedtls_ssl_ticket_free (mbedtls_ssl_ticket_context *ctx) mbedtls_ssl_ticket_free mbedtls_ssl_ticket_context * ctx

Free a context's content and zeroize it.

ctx

Context to be cleaned up

TLS server ticket callbacks implementation.

    /*
    *CopyrightTheMbedTLSContributors
    *SPDX-License-Identifier:Apache-2.0ORGPL-2.0-or-later
    */
    #ifndefMBEDTLS_SSL_TICKET_H
    #defineMBEDTLS_SSL_TICKET_H
    #include"mbedtls/private_access.h"

    #include"mbedtls/build_info.h"

    /*
    *Thisimplementationofthesessionticketcallbacksincludeskey
    *management,rotatingthekeysperiodicallyinordertopreserveforward
    *secrecy,whenMBEDTLS_HAVE_TIMEisdefined.
    */

    #include"mbedtls/ssl.h"
    #include"mbedtls/cipher.h"

    #ifdefined(MBEDTLS_HAVE_TIME)
    #include"mbedtls/platform_time.h"
    #endif

    #ifdefined(MBEDTLS_USE_PSA_CRYPTO)
    #include"psa/crypto.h"
    #endif

    #ifdefined(MBEDTLS_THREADING_C)
    #include"mbedtls/threading.h"
    #endif

    #ifdef__cplusplus
    extern"C"{
    #endif

    #defineMBEDTLS_SSL_TICKET_MAX_KEY_BYTES32
    #defineMBEDTLS_SSL_TICKET_KEY_NAME_BYTES4
    typedefstructmbedtls_ssl_ticket_key{
    unsignedcharMBEDTLS_PRIVATE(name)[MBEDTLS_SSL_TICKET_KEY_NAME_BYTES];
    #ifdefined(MBEDTLS_HAVE_TIME)
    mbedtls_time_tMBEDTLS_PRIVATE(generation_time);
    #endif
    uint32_tMBEDTLS_PRIVATE(lifetime);
    #if!defined(MBEDTLS_USE_PSA_CRYPTO)
    mbedtls_cipher_context_tMBEDTLS_PRIVATE(ctx);
    #else
    mbedtls_svc_key_id_tMBEDTLS_PRIVATE(key);
    psa_algorithm_tMBEDTLS_PRIVATE(alg);
    psa_key_type_tMBEDTLS_PRIVATE(key_type);
    size_tMBEDTLS_PRIVATE(key_bits);
    #endif
    }
    mbedtls_ssl_ticket_key;

    typedefstructmbedtls_ssl_ticket_context{
    mbedtls_ssl_ticket_keyMBEDTLS_PRIVATE(keys)[2];
    unsignedcharMBEDTLS_PRIVATE(active);
    uint32_tMBEDTLS_PRIVATE(ticket_lifetime);
    int(*MBEDTLS_PRIVATE(f_rng))(void*,unsignedchar*,size_t);
    void*MBEDTLS_PRIVATE(p_rng);
    #ifdefined(MBEDTLS_THREADING_C)
    mbedtls_threading_mutex_tMBEDTLS_PRIVATE(mutex);
    #endif
    }
    mbedtls_ssl_ticket_context;

    voidmbedtls_ssl_ticket_init(mbedtls_ssl_ticket_context*ctx);

    intmbedtls_ssl_ticket_setup(mbedtls_ssl_ticket_context*ctx,
    int(*f_rng)(void*,unsignedchar*,size_t),void*p_rng,
    mbedtls_cipher_type_tcipher,
    uint32_tlifetime);

    intmbedtls_ssl_ticket_rotate(mbedtls_ssl_ticket_context*ctx,
    constunsignedchar*name,size_tnlength,
    constunsignedchar*k,size_tklength,
    uint32_tlifetime);

    mbedtls_ssl_ticket_write_tmbedtls_ssl_ticket_write;

    mbedtls_ssl_ticket_parse_tmbedtls_ssl_ticket_parse;

    voidmbedtls_ssl_ticket_free(mbedtls_ssl_ticket_context*ctx);

    #ifdef__cplusplus
    }
    #endif

    #endif/*ssl_ticket.h*/