LIBRESSL-SSL_SET_PSK_USE_SESSION_CALLBACK(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🎀 SSL_set_psk_use_session_callback, SSL_psk_use_session_cb_func 🎀

okay so bestie, this is the Library Functions Manual (section 3) page for the TLS pre-shared-key client callback situation, and it is very much a LibreSSL stub era moment. 💅

🌸 NAME 🌸

SSL_set_psk_use_session_callback, SSL_psk_use_session_cb_func — set TLS pre-shared key client callback

✨ SYNOPSIS ✨

library “libssl” libcrypto #include <openssl/ssl.h>

typedef int
(*SSL_psk_use_session_cb_func)(SSL *ssl, const EVP_MD *md,
    const unsigned char **id, size_t *idlen, SSL_SESSION **session);

void
SSL_set_psk_use_session_callback(SSL *ssl,
    SSL_psk_use_session_cb_func cb);

💖 DESCRIPTION 💖

okay so the tea ☕: LibreSSL provides the stub function SSL_set_psk_use_session_callback() to allow compiling application programs that contain optional support for TLSv1.3 pre-shared keys. That's the whole assignment. 🫶

  • LibreSSL does not support TLS pre-shared keys, and no action occurs when SSL_set_psk_use_session_callback() is called. In particular, both arguments are ignored. both. of. them. 😭
  • During session negotiation, LibreSSL never calls the callback cb and always behaves as if that callback succeeded and set the *session pointer to NULL. It's giving "we are simply not doing that" energy. 💀
  • That is, LibreSSL never sends a pre-shared key to the server and never aborts the handshake for lack of a pre-shared key. Iconic non-behavior, honestly. ✨

Now, with OpenSSL, a client application wishing to use TLSv1.3 pre-shared keys can install a callback function cb using SSL_set_psk_use_session_callback(). The OpenSSL library may call cb once or twice during session negotiation. 👀

  • If the callback fails, OpenSSL aborts connection setup. like, handshake over.
  • If the callback succeeds but sets the *session pointer to NULL, OpenSSL continues the handshake but does not send a pre-shared key to the server.

🌈 RETURN VALUES 🌈

The SSL_psk_use_session_cb_func() callback is expected to return 1 on success or 0 on failure. That's the contract, bestie. ✅❌

🦋 HISTORY 🦋

SSL_set_psk_use_session_callback() and SSL_psk_use_session_cb_func() first appeared in OpenSSL 1.1.1 and have been available since OpenBSD 7.0. periodt. 👑

cute sign-off time: source/version is Debian, and the date is June 8, 20 — the raw footer literally runs the date straight into SSL_SET_PSK_USE_SESSION_CALLBACK(3), no cap. 💖🎀

📦 where this page comes from