RFC 4507
Transport Layer Security (TLS) Session Resumption without Server-Side State
RFC 4507 🎀
Transport Layer Security (TLS) Session Resumption without Server-Side State ✨
Network Working Group, Category: Standards Track, May 2006. Authors: J. Salowey (Cisco Systems), H. Zhou (Cisco Systems), P. Eronen (Nokia), and H. Tschofenig (Siemens). The title block doesn't list anything it obsoletes or updates. 🌸
Table of Contents
1. Introduction ....................................................3
2. Terminology .....................................................3
3. Protocol ........................................................3
3.1. Overview ...................................................4
3.2. SessionTicket TLS Extension ................................6
3.3. NewSessionTicket Handshake Message .........................7
3.4. Interaction with TLS Session ID ............................8
4. Recommended Ticket Construction .................................9
5. Security Considerations ........................................10
5.1. Invalidating Sessions .....................................11
5.2. Stolen Tickets ............................................11
5.3. Forged Tickets ............................................11
5.4. Denial of Service Attacks .................................11
5.5. Ticket Protection Key Management ..........................12
5.6. Ticket Lifetime ...........................................12
5.7. Alternate Ticket Formats and Distribution Schemes .........12
5.8. Identity Privacy, Anonymity, and Unlinkability ............12
6. Acknowledgements ...............................................13
7. IANA Considerations ............................................13
8. References .....................................................14
8.1. Normative References ......................................14
8.2. Informative References ....................................14Status of This Memo 📋
This document is an Internet standards track protocol spec for the Internet community. It also asks for discussion and suggestions for improvements 💬. For the current standardization state and status of this protocol, check the "Internet Official Protocol Standards" (STD 1) 📚. Distribution of this memo is unlimited 🌈.
Copyright Notice ©️
Copyright (C) The Internet Society (2006).
Abstract 🦋
This doc describes a mechanism that lets a TLS server resume sessions without keeping per-client session state, which is so iconic 💖. The server wraps the session state up in a ticket and sends it to the client 🎁. Later, the client can resume a session using that ticket ✨.
1. Introduction 🌷
Okay so this doc defines a way to resume a Transport Layer Security (TLS) session without needing session-specific state on the TLS server 🙈. This mechanism may be used with any TLS ciphersuite 🧚. This document applies to both TLS 1.0 defined in [RFC2246] and TLS 1.1 defined in [RFC4346] 💅. The mechanism makes use of TLS extensions defined in [RFC4366] and defines a new TLS message type 🔥.
This mechanism is useful in the following situations 👑:
- servers that handle a large number of transactions from different users
- servers that desire to cache sessions for a long time
- ability to load balance requests across servers
- embedded servers with little memory 🍓
2. Terminology 📖
Within this document, the term 'ticket' refers to a cryptographically protected data structure. The server creates it and then consumes it to rebuild session-specific state 🔐. Literally the whole point 💜.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀.
3. Protocol ⭐
This spec describes a mechanism for distributing encrypted session-state information in the form of a ticket 🎟️. A TLS server creates the ticket and sends it to a TLS client. Then the TLS client shows the ticket to the TLS server to resume a session 🫶. Implementations of this specification are expected to support both mechanisms 💅. Other specs can take advantage of session tickets, maybe by specifying other ways to distribute or select them 🦋. For example, a separate spec might describe an alternate way to distribute a ticket and use the TLS extension in this document to resume the session 🌸. That behavior is beyond the scope of this document and would need its own separate specification 🙃.
3.1. Overview 🧁
The client says it supports this mechanism by including a SessionTicket TLS extension in the ClientHello message 💖. The extension will be empty if the client doesn't already have a ticket for the server 🫧. More on the extension in Section 3.2 👀.
If the server wants to use this mechanism, it stores its session state (such as ciphersuite and master secret) in a ticket. That ticket is encrypted and integrity-protected by a key that only the server knows 🔑. The server sends the ticket to the client using the NewSessionTicket TLS handshake message described in Section 3.3. This message is sent during the TLS handshake before the ChangeCipherSpec message, after the server has successfully verified the client's Finished message 🎀. No cap, the timing is everything ⏰.
Client Server
ClientHello
(empty SessionTicket extension)------->
ServerHello
(empty SessionTicket extension)
Certificate*
ServerKeyExchange*
CertificateRequest*
<-------- ServerHelloDone
Certificate*
ClientKeyExchange
CertificateVerify*
[ChangeCipherSpec]
Finished -------->
NewSessionTicket
[ChangeCipherSpec]
<-------- Finished
Application Data <-------> Application DataFigure 1: Message flow for full handshake issuing new session ticket 🌈
The client caches this ticket along with the master secret and other parameters tied to the current session 🗂️. When the client wants to resume the session, it puts the ticket in the SessionTicket extension within the ClientHello message 💌. The server then decrypts the ticket it received, checks that the ticket is still valid, pulls the session state out of the ticket's contents, and uses that state to resume the session ✨. The interaction with the TLS Session ID is covered in Section 3.4 🦋. If the server successfully verifies the client's ticket, it can renew the ticket by including a NewSessionTicket handshake message after the ServerHello 💫. Renewal is a whole vibe 🌟.
Client Server
ClientHello
(SessionTicket extension) -------->
ServerHello
(empty SessionTicket extension)
NewSessionTicket
[ChangeCipherSpec]
<-------- Finished
[ChangeCipherSpec]
Finished -------->
Application Data <-------> Application DataFigure 2: Message flow for abbreviated handshake using new session ticket 💖
A recommended ticket format is in Section 4 🎀.
If the server can't or doesn't want to honor the ticket, it can start a full handshake with the client 🙅♀️.
If the server doesn't want to issue a new ticket at this time, it just completes the handshake without including a SessionTicket extension or NewSessionTicket handshake message. This flow is identical to Figure 1 in RFC 2246, except for the session ticket extension in the first message 🍓:
Client Server
ClientHello
(SessionTicket extension) -------->
ServerHello
Certificate*
ServerKeyExchange*
CertificateRequest*
<-------- ServerHelloDone
Certificate*
ClientKeyExchange
CertificateVerify*
[ChangeCipherSpec]
Finished -------->
[ChangeCipherSpec]
<-------- Finished
Application Data <-------> Application DataFigure 3: Message flow for server completing full handshake without issuing new session ticket 🧚
If the server rejects the ticket, it may still want to issue a new ticket after doing the full handshake, as shown below. This flow is identical to Figure 1, except the SessionTicket extension in the Client Hello is not empty 💅:
Client Server
ClientHello
(SessionTicket extension) -------->
ServerHello
(empty SessionTicket extension)
Certificate*
ServerKeyExchange*
CertificateRequest*
<-------- ServerHelloDone
Certificate*
ClientKeyExchange
CertificateVerify*
[ChangeCipherSpec]
Finished -------->
NewSessionTicket
[ChangeCipherSpec]
<-------- Finished
Application Data <-------> Application DataFigure 4: Message flow for server rejecting ticket, performing full handshake and issuing new session ticket 🌸
3.2. SessionTicket TLS Extension
Okay so the SessionTicket extension is built on [RFC4366] 💅 The ticket is an opaque blob that carries session-specific state ✨ This extension can show up in both the ClientHello and the ServerHello 🦋
If the client has a ticket it wants to resume with, it tucks that ticket into the SessionTicket extension in its ClientHello 🎀 If it doesn't have one but is ready to receive one in a NewSessionTicket handshake message, it MUST include a zero-length ticket in the SessionTicket extension 🌸 And if it's not ready to receive a ticket at all, it MUST NOT include a SessionTicket extension, unless it's sending a non-empty ticket it got some other way from the server 🙈
On the server side, a zero-length SessionTicket extension in the ServerHello basically says "hey, I'm going to send you a new ticket in a NewSessionTicket message (see Section 3.3) 🧚" The server MUST send this extension in the ServerHello if it wants to issue a new ticket that way. It MUST NOT send this extension if it didn't get one in the ClientHello 💀
If the server can't verify the ticket, it falls back to a full handshake 😭 If the ticket is accepted but the handshake then fails, the client SHOULD delete the ticket 🗑️
The SessionTicket extension has been assigned the number 35 🔥 Its format is at the end of this section 👑
struct {
opaque ticket<0..2^16-1>;
} SessionTicket;3.3. NewSessionTicket Handshake Message
This message is sent by the server during the TLS handshake, before the ChangeCipherSpec message 🌈 If the server put a SessionTicket extension in the ServerHello, it MUST send this message ✨ And if it didn't include the extension, it MUST NOT send this message. Period 💅 For a full handshake, the server MUST verify the client's Finished message before sending the ticket 🫶 The client MUST NOT treat the ticket as valid until it has verified the server's Finished message 🔐 Now, if the server changes its mind after putting the SessionTicket extension in the ServerHello and doesn't want to include a ticket, it sends a zero-length ticket in the NewSessionTicket message instead 🙃
If the server successfully verifies the client's ticket, it MAY renew that ticket by including a NewSessionTicket message after the ServerHello in the abbreviated handshake 🦋 The client should start using the new ticket as soon as possible after it verifies the server's Finished message for new connections 🏃♀️ Heads up though: since the updated ticket gets issued before the handshake finishes, the client might not actually put it into use before it starts new connections 👀 That's why the server MUST NOT assume the client actually received the updated ticket until it successfully verifies the client's Finished message 🙅♀️
The NewSessionTicket handshake message has been assigned the number 4, and its definition is at the end of this section 🎀 The ticket_lifetime_hint field is the server's hint about how long the client should keep the ticket 🕰️ The value is the lifetime in seconds, as a 32-bit unsigned integer in network byte order 🔢 A value of zero is reserved to mean the ticket's lifetime is unspecified 🌀 A client SHOULD delete the ticket and its associated state when that time runs out 🧹 It MAY delete the ticket sooner based on local policy 📋 And a server MAY treat a ticket as valid for a shorter or longer period than what the ticket_lifetime_hint says 🤷♀️
struct {
HandshakeType msg_type;
uint24 length;
select (HandshakeType) {
case hello_request: HelloRequest;
case client_hello: ClientHello;
case server_hello: ServerHello;
case certificate: Certificate;
case server_key_exchange: ServerKeyExchange;
case certificate_request: CertificateRequest;
case server_hello_done: ServerHelloDone;
case certificate_verify: CertificateVerify;
case client_key_exchange: ClientKeyExchange;
case finished: Finished;
case session_ticket: NewSessionTicket; /* NEW */
} body;
} Handshake;
struct {
uint32 ticket_lifetime_hint;
opaque ticket<0..2^16-1>;
} NewSessionTicket;3.4. Interaction with TLS Session ID
If a server plans to issue a SessionTicket to a client that didn't present one, it SHOULD include an empty Session ID in the ServerHello 🌸 If the server includes a non-empty Session ID, that's a signal it intends to use stateful session resumption instead 🧠 And when the client gets a SessionTicket from the server, it throws away any Session ID that came in the ServerHello 🗑️
When presenting a ticket, the client MAY generate and include a Session ID in the TLS ClientHello 🎀 If the server accepts the ticket and the Session ID isn't empty, it MUST respond with that same Session ID from the ClientHello 💖 This is how the client can easily tell whether the server is resuming a session or falling back to a full handshake 👯 Since the client made up that Session ID, the server MUST NOT rely on it having any particular value when validating the ticket 🙅♀️ And if the client presents a ticket, the server MUST NOT try to use the ClientHello's Session ID for stateful session resumption 🚫 Alternatively, the client MAY include an empty Session ID in the ClientHello 🫧 In that case, the client ignores the Session ID sent in the ServerHello and works out whether the server is resuming a session from the handshake messages that follow 🔍
4. Recommended Ticket Construction
This section describes a recommended format and protection for the ticket 📦 The ticket is opaque to the client, so its structure isn't a interoperability concern, and implementations are free to diverge from this format 🦋 But if they do diverge, they really need to take security seriously 😤 Clients MUST NOT examine the ticket under the assumption that it follows this document 🙈
The server uses two different keys: one 128-bit key for AES [AES] in CBC mode [CBC] encryption, and one 128-bit key for HMAC-SHA1 [RFC2104] [SHA1] 🔑🔑
The ticket is structured like this 👇
struct {
opaque key_name[16];
opaque iv[16];
opaque encrypted_state<0..2^16-1>;
opaque mac[20];
} ticket;Here, key_name identifies a particular set of keys used to protect the ticket 🏷️ That's how the server can easily recognize tickets it issued itself 👀 The key_name should be randomly generated so it doesn't collide with other servers' names 🎲 One option is to generate fresh random keys and a fresh key_name every time the server starts up 🔄
The actual state info in encrypted_state is encrypted with 128-bit AES in CBC mode, using the given IV 🔐 The MAC is calculated with HMAC-SHA1 over key_name (16 octets) and IV (16 octets), followed by the length of the encrypted_state field (2 octets) and its contents (variable length) 🧮
struct {
ProtocolVersion protocol_version;
CipherSuite cipher_suite;
CompressionMethod compression_method;
opaque master_secret[48];
ClientIdentity client_identity;
uint32 timestamp;
} StatePlaintext;
enum {
anonymous(0),
certificate_based(1),
psk(2)
} ClientAuthenticationType;
struct {
ClientAuthenticationType client_authentication_type;
select (ClientAuthenticationType) {
case anonymous: struct {};
case certificate_based:
ASN.1Cert certificate_list<0..2^24-1>;
case psk:
opaque psk_identity<0..2^16-1>; /* from [RFC4279] */
}
} ClientIdentity;StatePlaintext is where the TLS session state lives, including the master_secret 🗝️ Its timestamp field lets the TLS server expire tickets ⏰ To cover the authentication and key exchange protocols TLS offers, the ClientIdentity structure holds the client's authentication type from the initial exchange (see ClientAuthenticationType) 🪪 To give the TLS server the same abilities for authentication and authorization, a certificate list is included when public-key-based authentication is used 📜 That means the TLS server can inspect a bunch of different attributes in those certificates 🕵️♀️ An implementation might store just a subset of this info, or add extra info of its own 🧩 Other authentication mechanisms, like Kerberos [RFC2712], would need different client identity data 🎫
5. Security Considerations
Okay, this part is seriously important 😭 This section covers security issues related to using a ticket 🔐 Tickets MUST be authenticated and encrypted to stop an attacker from modifying them or eavesdropping on them 🛡️ Several attacks described below will be possible if this isn't done carefully 💀
Implementations should take care that processing tickets doesn't increase the chance of denial of service, as described below 🚨
5.1. Invalidating Sessions
The TLS specification requires that TLS sessions be invalidated when errors occur 🙅♀️ [CSSC] digs into the security implications of this in detail 📚 In the analysis in that paper, failing to invalidate sessions doesn't pose a security risk 🙌 That's because the TLS handshake uses a non-reversible function to derive keys for a session, so information about one session doesn't give an attacker an edge against the master secret or a different session 🧠 If a session invalidation scheme is used, the implementation should verify the integrity of the ticket before using its contents to invalidate a session, so an attacker can't invalidate a session they've picked 🕵️♀️
5.2. Stolen Tickets
An eavesdropper or man-in-the-middle might grab the ticket and try to use it to set up a session with the server 👀 But the ticket is encrypted, and the attacker doesn't know the secret key, so a stolen ticket doesn't help them resume a session 🙌 Still, a TLS server MUST use strong encryption and integrity protection for the ticket, so an attacker can't brute force their way to the ticket's contents 💪
5.3. Forged Tickets
A malicious user could forge or alter a ticket to resume a session, extend its lifetime, impersonate another user, or gain extra privileges 😈 This attack isn't possible if the ticket is protected with a strong integrity protection algorithm, such as a keyed HMAC-SHA1 🔒
5.4. Denial of Service Attacks
The key_name field in the recommended ticket format helps the server quickly reject tickets it didn't issue 🏃♀️ But an adversary could store or generate a huge pile of tickets and send them to the TLS server for verification 📈 To keep the chance of denial of service low, verifying a ticket should be lightweight (e.g., using efficient symmetric key cryptographic algorithms) ⚡
5.5. Ticket Protection Key Management ✨
okay so the full scoop on managing the keys that protect the ticket is beyond this doc 💅, but there's a list of RECOMMENDED practices, and they're honestly giving good advice 🔐
- The keys should be generated securely, following the randomness recommendations in [RFC4086].
- The keys and cryptographic protection algorithms should be at least 128 bits in strength.
- The keys should not be used for any other purpose than generating and verifying tickets.
- The keys should be changed regularly.
- The keys should be changed if the ticket format or cryptographic protection algorithms change.
5.6. Ticket Lifetime ⏳
the TLS server is the one in charge of how long a ticket lasts 👑 Servers pick an acceptable lifetime based on the operational and security needs of wherever they're deployed. The ticket lifetime may be longer than the 24-hour lifetime recommended in [RFC2246], so no need to panic if it's longer 🌸 TLS clients may also be given a hint about how long the ticket lasts. Since a ticket's lifetime may be unspecified, the client has its own local policy for deciding when to toss its tickets 🗑️
5.7. Alternate Ticket Formats and Distribution Schemes 🧚
if you're NOT using the ticket format or distribution scheme defined in this document, then great care must be taken when analysing the security of your solution 😬 Like, if something confidential (say, a secret key) gets sent to the client, it MUST be done using secure communication so attackers can't grab it or mess with it. Also, the ticket MUST have its integrity and confidentiality protected with strong cryptographic techniques, or the whole system could get breached. no shortcuts, bestie 🔒
5.8. Identity Privacy, Anonymity, and Unlinkability 🦋
this document says the ticket's contents MUST be confidentiality protected so nothing leaks, like user-relevant info 🙈 So any sensitive stuff stored in the ticket stays private, which is iconic. HOWEVER, the initial handshake that got the ticket might not give the client identity confidentiality, based on how TLS works 😭 Another threat is an on-path adversary watching several TLS handshakes that reuse the same ticket and concluding they all come from the same endpoints. So application designers using this ticket mechanism should consider that unlinkability [ANON] is not necessarily provided. not everything is guaranteed, so plan accordingly 💜
A full discussion of these topics is beyond this document, but it's worth knowing that a ticket can be issued using a TLS renegotiation handshake that happens after a secure tunnel is already set up by an earlier handshake. This may help with some privacy and unlinkability issues in some environments ✨
6. Acknowledgements 🫶
big thank-you to everyone who helped the authors prepare and review this doc: Eric Rescorla, Mohamad Badra, Tim Dierks, Nelson Bolyard, Nancy Cam-Winget, David McGrew, Rob Dugal, Russ Housley, Amir Herzberg, Bernard Aboba, and the members of the TLS working group 💖
[CSSC] describes a solution that's very similar to the one in this document and gives a detailed analysis of the security considerations involved, so go read it if you want the deep dive 🤓 [RFC2712] describes a mechanism for using Kerberos [RFC4120] in TLS ciphersuites, which helped inspire using tickets to avoid keeping state on the server. [EAP-FAST] uses a similar mechanism to avoid maintaining server state for the cryptographic tunnel. And [SC97] also looks into the concept of stateless sessions 🧠
7. IANA Considerations 📋
IANA assigned the SessionTicket TLS extension the number 35, from the TLS registry of ExtensionType values defined in [RFC4366] 🎀
IANA also assigned the NewSessionTicket handshake type the TLS HandshakeType number 4, from the TLS registry of HandshakeType values defined in [RFC4346] 🌈
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
RFC 2246, January 1999.
[RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.1", RFC 4346, April 2006.
[RFC4366] Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen,
J., and T. Wright, "Transport Layer Security (TLS)
Extensions", RFC 4366, April 2006.8.2. Informative References
[AES] National Institute of Standards and Technology, "Advanced
Encryption Standard (AES)", Federal Information
Processing Standards (FIPS) Publication 197,
November 2001.
[ANON] Pfitzmann, A. and M. Hansen, "Anonymity, Unlinkability,
Unobservability, Pseudonymity, and Identity Management -
A Consolidated Proposal for Terminology",
http://dud.inf.tu-dresden.de/literatur/
Anon_Terminology_v0.26-1.pdf, Draft 0.26, December 2005.
[CBC] National Institute of Standards and Technology,
"Recommendation for Block Cipher Modes of Operation -
Methods and Techniques", NIST Special Publication 800-
38A, December 2001.
[CSSC] Shacham, H., Boneh, D., and E. Rescorla, "Client-side
caching for TLS", Transactions on Information and System
Security (TISSEC) , Volume 7, Issue 4, November 2004.
[EAP-FAST] Cam-Winget, N., McGrew, D., Salowey, J., and H. Zhou,
"EAP Flexible Authentication via Secure Tunneling (EAP-
FAST)", Work in Progress, April 2005.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104,
February 1997.
[RFC2712] Medvinsky, A. and M. Hur, "Addition of Kerberos Cipher
Suites to Transport Layer Security (TLS)", RFC 2712,
October 1999.
[RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness
Requirements for Security", BCP 106, RFC 4086, June 2005.
[RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
Kerberos Network Authentication Service (V5)", RFC 4120,
July 2005.
[RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key
Ciphersuites for Transport Layer Security (TLS)",
RFC 4279, December 2005.
[SC97] Aura, T. and P. Nikander, "Stateless Connections",
Proceedings of the First International Conference on
Information and Communication Security (ICICS '97), 1997.
[SHA1] National Institute of Standards and Technology, "Secure
Hash Standard (SHS)", Federal Information Processing
Standards (FIPS) Publication 180-2, August 2002.Authors' Addresses 🏡
Joseph Salowey
Cisco Systems
2901 3rd Ave
Seattle, WA 98121
US
EMail: jsalowey@cisco.com
Hao Zhou
Cisco Systems
4125 Highlander Parkway
Richfield, OH 44286
US
EMail: hzhou@cisco.com
Pasi Eronen
Nokia Research Center
P.O. Box 407
FIN-00045 Nokia Group
Finland
EMail: pasi.eronen@nokia.com
Hannes Tschofenig
Siemens
Otto-Hahn-Ring 6
Munich, Bayern 81739
Germany
EMail: Hannes.Tschofenig@siemens.comFull Copyright Statement ©
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔏
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 💌
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 🌸
📦 where this page comes from
- ietf: rfc4507 2006-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms