[gnutls-devel] GnuTLS | borinssl early data is rejected by gnutls server because of the ticket age (#1403)

Read-only notification of GnuTLS library development activities gnutls-devel at lists.gnutls.org
Tue Sep 13 12:01:02 CEST 2022

Tatsuhiro Tsujikawa created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1403

## Description of problem:

I often observed that boringssl early data got rejected by gnutls server due to ticket age:

> gnutls[3]: ASSERT: tls13/anti_replay.c[_gnutls_anti_replay_check]:152
> gnutls[4]: EXT[0x...]: replay detected; rejecting early data

That is https://gitlab.com/gnutls/gnutls/-/blob/84546da2c30d84a7aaeaf82af1f6d0b101b54d81/lib/tls13/anti_replay.c#L147-151

	/* It shouldn't be possible that the server's view of ticket
	 * age is smaller than the client's view.

Whey does this happen?  Because boringssl drops sub-second when calculating obfuscated_ticket_age:


It looks like RFC 8446 only says that "a server MUST validate
that the ticket age for the selected PSK identity ... is within a small tolerance of the time since the ticket
was issued".  This particular check done by gnutls might be too strict.

## Version of gnutls used:

master branch

## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)

## How reproducible:

Send early data from boringssl client to gnutls server.
Do this several times and see the early data rejection by gnutls server.

## Actual results:

Early data from boringssl client is often rejected.

## Expected results:

Early data from boringssl client should be accepted if the ticket age is within the acceptable range.

Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1403
You're receiving this email because of your account on gitlab.com.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20220913/8323f63d/attachment.html>

More information about the Gnutls-devel mailing list