[gnutls-devel] GnuTLS | Update docs for session ticket key rotation (!768)

[Development of GNU's TLS library]

Nikos Mavrogiannopoulos started a new discussion on doc/cha-gtls-app.texi:

>  Those keys should be associated with the GnuTLS session using
> - at funcref{gnutls_session_ticket_enable_server}, and should be rotated regularly
> -(e.g., every few hours), to prevent them from becoming long-term keys which
> -if revealed could be used to decrypt all previous sessions.
> + at funcref{gnutls_session_ticket_enable_server}.
> +
> +Those will be the initial keys, but GnuTLS will rotate them regularly. The key rotation interval
> +can be changed with @funcref{gnutls_db_set_cache_expiration}. The key rotation interval will be
> +three times the ticket expiration time (ie. three times the value given in that function).
> +Every such interval, new keys will be generated from those initial keys. This is a necessary mechanism
> +to prevent the keys from becoming long-term keys
> +and as such preserve forward-secrecy in the issued session tickets. If no explicit key rotation interval
> +is provided, GnuTLS will rotate them every 18 hours by default.
> +
> +The master key can be shared between processes or between systems. Processes which share the same master key
> +will generate the same rotated subkeys, assuming they share the same time.

Maybe a clarification here:
```
assuming they share the same time (irrespective of timezone differences).
```
To underline that the generated keys do not depend on timezones and thus you can use the same key in differently located servers.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/768#note_108196466
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20181011/53f1e2f2/attachment-0001.html>