Senior LevelAuthentication & Authorization
How do TLS Session Tickets (RFC 5077 / TLS 1.3) execute stateless TLS session resumption?
❓ Interview Prompt: Explain TLS Session Resumption, Session IDs vs Session Tickets (RFC 5077), STEK key rotation, and 0-RTT handshake risks.
Establishing a new TLS 1.3 connection requires asymmetric cryptographic handshakes that consume CPU and add latency. TLS Session Resumption re-uses previously negotiated cryptographic parameters.
TLS Session Tickets (RFC 5077) Mechanics:
1
At the end of an initial handshake, the server sends a Session Ticket containing encrypted session parameters.
2
The ticket is encrypted with a secret Session Ticket Encryption Key (STEK) known only to the server cluster.
3
When reconnecting, the client sends the ticket in its 'ClientHello'.
4
The server decrypts the ticket using its STEK, resuming the session in 0-RTT or 1-RTT without looking up server-side state!
5
STEK Rotation: STEK keys must be rotated daily across servers to preserve Perfect Forward Secrecy (PFS).
Code Implementation Example
typescript
// Node.js HTTPS server TLS session resumption ticket event
import https from 'https';
const server = https.createServer(options);
// Configure TLS session ticket key rotation (STEK)
server.on('newSession', (sessionId, sessionData, callback) => {
// Client received session ticket
callback();
});
server.on('resumeSession', (sessionId, callback) => {
// Decrypt & validate stateless TLS session ticket
callback(null, retrievedSessionBuffer);
});💡Handling TLS session ticket resumption events in Node.js HTTPS server.
🎯 Interview Key Takeaway
TLS Session Tickets (RFC 5077) store encrypted session state on the client, resuming TLS connections in 0-RTT without server state.
#TLS#Session Resumption#RFC 5077#STEK#Senior
Back to all Authentication & Authorization Questions→