s2n-tls icon indicating copy to clipboard operation
s2n-tls copied to clipboard

Add API to generate local host session ticket keys

Open raycoll opened this issue 2 years ago • 0 comments

The goal of the API(s2n_config_generate_local_ticket_crypto_key) is to make it simpler for applications that want to generate a session ticket key that will be used locally on the host(not shared among a fleet of servers). The API takes no secrets as argument from the user to prevent any possibility of misuse.

Before this API was added, applications generated a session local session ticket by generating secret key material and name themselves and then providing them as arguments to s2n_config_add_ticket_crypto_key.

TODO

  • [x] Determine if it still makes sense for s2n_config_generate_local_ticket_crypto_key to take intro_time_in_seconds_from_epoch as argument(should s2n just assume the key should be put in service immediately?
  • [x] Update s2nd to use s2n_config_generate_local_ticket_crypto_key by default
  • [x] Add unit tests
  • [x] Update USAGE-GUIDE.md

Testing:

TODO: unit test.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

raycoll avatar Apr 01 '22 15:04 raycoll