On Aug 18, 2023, at 5:46 AM, Vadim Cargatser (vcargats) <[email protected]> wrote: > In TLS 1.2: the ticket is part of the handshake, so we cannot bind that with > the successful inner authentication, correct?
Yes. However, RFC 9190 goes into detail about "don't send tickets until after authentication has completed". Or "don't allow tickets to be used until after authentication has been completed". These are issues common to all TLS-based EAP types. I'm not sure we need to call them out here. > In TLS 1.3: that should be possible to issue a ticket after the handshake, so > are we ok with such approach to perform inner methods resumption? I don't see why we would want to _allow_ inner method resumption. What benefit does it bring over just using resumption on the outer TLS session? > Is it worth explaining more on that in the document? I'll update it to ban inner method resumption. I think that's the best approach. Alan DeKok. _______________________________________________ Emu mailing list [email protected] https://www.ietf.org/mailman/listinfo/emu
