RFC 9149

TLS Ticket Requests

📅 published April 2022, from ietf

RFC 9149: TLS Ticket Requests 🎀

okay bestie, let's get into it ✨ this is an IETF Standards Track doc, so it's the real deal, and it was published in April 2022 🌸 The authors are T. Pauly (Apple Inc.), D. Schinazi (Google LLC), and C.A. Wood (Cloudflare) 💜 It's Request for Comments 9149, ISSN 2070-1721, and it doesn't obsolete or update anything else 🦋

Abstract ✨

okay so TLS session tickets are what let a client resume a connection without the server having to keep any per-client state 🧚 Servers hand out however many tickets they want, whenever they feel like it, during connection setup, and clients store them and use them later when they reconnect 💅 This doc adds a way for clients to say how many tickets they'd like for future connections 🫶 The whole point is that servers can figure out how many tickets to make, so they don't waste them, and clients still get primed for what's coming next 🔥

Status of This Memo 🌈

this is an Internet Standards Track doc 💖 It comes from the IETF, it reflects consensus from the IETF community, got public review, and was approved for publication by the IESG 👑 If you want more on Internet Standards, check out Section 2 of RFC 7841 ⭐ You can find the status, errata, and feedback info at https://www.rfc-editor.org/info/rfc9149 🌸

Copyright Notice 💜

Copyright (c) 2022 IETF Trust and the persons identified as the document authors, all rights reserved 🎀 This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as of the publication date, so please read those carefully because they spell out your rights 🙈 Any Code Components pulled out of this doc have to include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, same as the Revised BSD License says 🦋

Table of Contents 🧚

1. Introduction
- 1.1. Requirements Language
2. Use Cases
3. Ticket Requests
4. IANA Considerations
5. Performance Considerations
6. Security Considerations
7. References
- 7.1. Normative References
- 7.2. Informative References
Acknowledgements
Authors' Addresses

1. Introduction 💖

okay so, as [RFC8446] explains, TLS servers give clients however many session tickets they want, whenever they want, in NewSessionTicket messages 🌸 But this design has at least three limitations, and bestie, we're going to go through all of them 😭

First, servers hand out some number of tickets per connection that's often hard-coded 💀 Some server implementations send a different default number for resumption than they do for the first connection that created the session 🙈 No static choice, whether it's fixed or depends on resumption, works well for every situation 🍓

Second, clients have no way to say how many tickets they want, and that can mess with future connections 😤 For example, clients can open parallel TLS connections to the same server for HTTP, or they can race TLS connections across different network interfaces 🦋 The second one is especially helpful in transport systems that do Happy Eyeballs [RFC8305] ✨ Since clients control connection concurrency and resumption, we really need a standard way to ask for more than one ticket so we can avoid ticket reuse 💅 For the risks of ticket reuse, see Appendix C.4 of [RFC8446] 📖

Third, every ticket a client has ultimately comes from some initial connection 🧚 Especially when the client first authenticated with a client certificate, that session may need a refresh every now and then 🌈 So a server might periodically force a fresh connection even when the client shows a valid ticket 😳 When that happens, any other tickets from that same original session could be just as invalid 💔 A client skips the full handshake on later connections if it swaps out all its stored tickets for new ones from the full handshake it just did 🫶 So the number of tickets a server should hand out for a new connection might need to be bigger than the number for routine resumption 🔥

This doc specifies a new TLS extension called "ticket_request", which clients can use to say how many session tickets they want 👑 Servers can treat this extension as a hint for how many NewSessionTicket messages to send ✨ This extension only applies to TLS 1.3 [RFC8446], DTLS 1.3 [RFC9147], and future versions of (D)TLS 🎀

1.1. Requirements Language 🌸

okay, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this doc are to be read as BCP 14 [RFC2119] [RFC8174] says, but only when they show up in all capitals, just like here 💜

2. Use Cases 🦋

the ability to ask for one or more tickets is useful for a bunch of stuff 🧚

Parallel HTTP connections: to make things faster, a client might open parallel connections 🚀 To avoid ticket reuse, the client might use a different ticket on each connection 💖 So clients MUST bound the number of parallel connections they start by how many tickets they have, or else they risk ticket reuse 😱

Connection racing: Happy Eyeballs V2 [RFC8305] describes how connection racing works 🌈 The Transport Services Implementation document [TAPS] also describes how connections can race across interfaces and address families 🏃‍♀️ In these cases, clients might use more than one ticket while racing connection attempts so they can end up with one successful connection 🎯 Having multiple tickets gives clients enough to start a connection race while avoiding ticket reuse and making sure their ticket cache doesn't run dry during the race 💅 Plus, since some servers might use single-use tickets, distinct tickets stop racing from invalidating tickets too early 🫶

Less ticket waste: right now, TLS servers use application-specific (and often implementation-specific) logic to decide how many tickets to issue 🤔 By moving the ticket count job over to clients, servers stop generating wasteful tickets 🌸 For example, clients might only ask for one ticket during resumption ✨ And since ticket generation can be expensive, like with public key crypto operations, avoiding waste is a big deal 💰

Decline resumption: clients can say they don't plan to resume a connection by sending a ticket request with a count of zero 🙅‍♀️

3. Ticket Requests 👑

as we talked about in Section 1, clients might want different numbers of tickets for new connections or resumed ones 💖 Clients can tell servers how many tickets they want to receive on a single connection, whether it's new or resumed, using the following "ticket_request" extension 🎀

enum {
    ticket_request(58), (65535)
} ExtensionType;

Clients MAY send this extension in ClientHello 🌸 It contains the following structure:

struct {
    uint8 new_session_count;
    uint8 resumption_count;
} ClientTicketRequest;

new_session_count: the number of tickets the client wants if the server goes with a new connection 🧚

resumption_count: the number of tickets the client wants if the server is willing to resume using a ticket presented in this ClientHello 🦋

A client starting a new connection SHOULD set new_session_count to the number of session tickets it wants and set resumption_count to 0 ✨ Once a client's ticket cache is primed, a resumption_count of 1 is a good pick, since it lets the server swap each ticket for a new one without overloading the client with extra tickets 💅 However, clients that race multiple connections and put a separate ticket in each will eventually end up with just the tickets from one resumed session 😭 In that case, clients can send a resumption_count equal to the number of connections they're attempting in parallel 🌈 (Clients that send a resumption_count less than the number of parallel connection attempts might end up with zero tickets 💀)

When a client presents a previously obtained ticket but the server still negotiates a new connection, the client SHOULD assume that any other tickets tied to the same session as the presented ticket are no longer valid for resumption either 🙈 That covers tickets from the initial (new) connection and all tickets obtained later from subsequent resumptions 🫶 Requesting more than one ticket when servers complete a new connection helps keep the session cache primed 🔥

Servers SHOULD NOT send more tickets than requested for the connection type the server picked (new or resumed) 🙅‍♀️ Also, servers SHOULD set a limit on how many tickets they're willing to send, whether for new or resumed connections, to save resources 💜 So the number of NewSessionTicket messages sent will usually be the smaller of the server's self-imposed limit and the number requested 👑 Servers MAY send additional tickets, usually using that same limit, if the originally sent tickets somehow get invalidated 🦋

A server that supports and uses a client "ticket_request" extension MUST also send the "ticket_request" extension in its EncryptedExtensions message 🎀 It contains the following structure:

struct {
    uint8 expected_count;
} ServerTicketRequestHint;

expected_count: the number of tickets the server expects to send in this connection 🌸

Servers MUST NOT send the "ticket_request" extension in any handshake message, including ServerHello or HelloRetryRequest messages 🙅‍♀️ A client MUST abort the connection with an "illegal_parameter" alert if the "ticket_request" extension shows up in any server handshake message 😱

If a client gets a HelloRetryRequest, the presence (or absence) of the "ticket_request" extension MUST be kept in the second ClientHello message 🧚 Also, if this extension is present, a client MUST NOT change the value of ClientTicketRequest in the second ClientHello message 💅

4. IANA Considerations 🌈

IANA has added the following entry to the "TLS ExtensionType Values" registry [RFC8446] [RFC8447] 📋

+=======+================+=========+===========+=============+
| Value | Extension Name | TLS 1.3 | DTLS-Only | Recommended |
+=======+================+=========+===========+=============+
| 58    | ticket_request | CH, EE  | N         | Y           |
+-------+----------------+---------+-----------+-------------+

    Table 1: Addition to TLS ExtensionType Values Registry

Part 1 of 2. Part 2 picks up with Section 5 (Performance Considerations), Section 6 (Security Considerations), the References, Acknowledgements, and Authors' Addresses 💖

5. Performance Considerations 🚀

Servers can send tickets in NewSessionTicket messages any time after the server Finished message (see Section 4.6.1 of [RFC8446]). Okay, but here's the catch 👀. If a server sends a huge pile of tickets before any actual application data goes out, that can seriously hurt performance. For example, if the transport connection has a constrained congestion window, all those ticket messages could hold up the application data 😭. So to avoid this, servers should prioritize sending application data over tickets when possible 💅✨.

6. Security Considerations 🔐

Okay bestie, this section is serious, so grab a snack and pay attention 🫶. Ticket reuse is a security and privacy concern 🚨. Clients also have to be careful when pooling tickets to dodge or amortize handshake costs, because it's easy to get sloppy there 🙈. If servers don't rotate session ticket encryption keys often, clients may get encouraged to hang onto and use tickets way past the usual lifetime windows of, e.g., 24 hours 💀. Even with the ticket lifetime hints servers give, clients SHOULD dispose of cached tickets after a reasonable amount of time that mirrors the session ticket encryption key rotation period 🗑️. Specifically, as spelled out in Section 4.6.1 of [RFC8446], clients MUST NOT cache tickets for longer than 7 days 🛑. No exceptions, no vibes-based caching.

Now for the spicy part 🌶️. In some cases, a server may send NewSessionTicket messages right after the server Finished message, instead of waiting for the client Finished message 👀. If the server hasn't verified the client actually owns its IP address (for example, with the TLS cookie extension, see Section 4.2.2 of [RFC8446]), an attacker can use this to run an amplification attack that scales with the count value 😱. They do it by starting a (DTLS) key exchange over UDP with spoofed packets, aimed at a target 🎯. So servers SHOULD limit how many NewSessionTicket messages they send until they've verified the client's ownership of its IP address 🔒. Protect yourself, periodt.

Last but not least, servers that don't put a limit on the number of NewSessionTicket messages sent in response to a "ticket_request" extension could leave themselves wide open to DoS attacks 🚒, especially if ticket creation is expensive 💸. Main character energy is not being a free-for-all.

7. References 📚

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
           Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
           <https://www.rfc-editor.org/info/rfc8446>.

[RFC8447]  Salowey, J. and S. Turner, "IANA Registry Updates for TLS
           and DTLS", RFC 8447, DOI 10.17487/RFC8447, August 2018,
           <https://www.rfc-editor.org/info/rfc8447>.

[RFC9147]  Rescorla, E., Tschofenig, H., and N. Modadugu, "The
           Datagram Transport Layer Security (DTLS) Protocol Version
           1.3", RFC 9147, DOI 10.17487/RFC9147, April 2022,
           <https://www.rfc-editor.org/info/rfc9147>.

7.2. Informative References

[RFC8305]  Schinazi, D. and T. Pauly, "Happy Eyeballs Version 2:
           Better Connectivity Using Concurrency", RFC 8305,
           DOI 10.17487/RFC8305, December 2017,
           <https://www.rfc-editor.org/info/rfc8305>.

[TAPS]     Brunstrom, A., Ed., Pauly, T., Ed., Enghardt, T., Tiesel,
           P., and M. Welzl, "Implementing Interfaces to Transport
           Services", Work in Progress, Internet-Draft, draft-ietf-
           taps-impl-12, 7 March 2022,
           <https://datatracker.ietf.org/doc/html/draft-ietf-taps-
           impl-12>.

Acknowledgements 💖

Huge shoutout to David Benjamin, Eric Rescorla, Nick Sullivan, Martin Thomson, Hubert Kario, and the other members of the TLS Working Group 🫶. They all helped out with discussions on earlier draft versions of this document. And Viktor Dukhovni gets a special crown 👑 for contributing the text that lets clients send multiple counts in a ticket request. Iconic behavior.

Authors' Addresses 🦋

Tommy Pauly
Apple Inc.
One Apple Park Way
Cupertino, CA 95014
United States of America
Email: tpauly@apple.com


David Schinazi
Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
United States of America
Email: dschinazi.ietf@gmail.com


Christopher A. Wood
Cloudflare
101 Townsend St
San Francisco, CA 94107
United States of America
Email: caw@heapingbits.net

📦 where this page comes from

ietf: rfc9149 2022-04
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms