Go: proposal: crypto/tls: implement Session IDs resumption

[pvoicu]

What version of Go are you using (go version)?

go version go1.10 linux/amd64

Does this issue reproduce with the latest release?

Yes

What did you do?

Crypto/tls today only implements session ticket resumption described in RFC 5077. Per https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Extensions JSSE does not support session ticket resumption, so I'm looking for a way to speed up the TLS handshake between Golang and Java applications

https://tools.ietf.org/html/rfc5246 (The Transport Layer Security (TLS) Protocol Version 1.2) describes the session resumption, also useful to speed up the TLS handshake. It is implemented by OpenSSL and JSSE. Implementation should have a public interface similar to the OpenSSL's SSL_CTX_add_session() to inject the sessions in the server cache.

[FiloSottile]

TLS 1.3 might also need server side state to handle 0-RTT anti-replay.

If that happens, 1.2 Session IDs can be implemented along with that.

[pvoicu]

I have an implementation for this, although only for the server side because that is what I needed.
I would be glad to contribute.

[a13xb]

We have encountered (probably bad) embedded TLS client implementations that refuse to talk to Go TLS server because session ID resumption is not implemented, so we had to insert NGINX in front to make it work.

This would be a welcome addition.

[rs]

This would also be needed in order to support TLS resumption (at all) for iOS as based on my tests, this platform does not send session tickets (neither Safari nor apps), and there is no obvious way to unable it from NSURLSession.

[agdolla]

java 13 implements RFC 5077
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8211018
you have to enable it with:
-Djdk.tls.client.enableSessionTicketExtension=true
-Djdk.tls.server.enableSessionTicketExtension=true

[FiloSottile]

This is terrifying: it looks like there are FTP servers that use session reuse as an authentication method across control and data connections, and some of them don't support session tickets, so need session IDs. https://github.com/secsy/goftp/issues/49

https://scarybeastsecurity.blogspot.com/2009/02/vsftpd-210-released.html