ssl: TLS-1.2 session reuse and client certs

Make session_reuse disabled by default when client certificates
are requierd, until extend master secret can be implemented.
But best option is to run TLS-1.3.

Author: IngelaAndin

lib/ssl/doc/guides/ssl_hardening.md

@@ -174,6 +174,35 @@ avoid possible [DoS-attacks](https://en.wikipedia.org/wiki/Denial-of-service_att
 By default, the server mitigates renegotiation abuse by enforcing a
 12-second delay between client initiated renegotiations.
 
+### TLS 1.2 Session Resumption and Client Certificates
+
+> #### Warning {: .warning }
+> TLS 1.2 session resumption (session ID and RFC 5077 tickets) does
+> not bind the master secret to the handshake transcript. When client
+> certificate authentication is required, this leaves the connection
+> vulnerable to the Triple Handshake attack (see RFC 7627). This
+> concern does not apply to TLS 1.3, which binds all session keys to
+> the full transcript.
+
+If your TLS 1.2 server uses {verify, verify_peer} to require client
+certificates make sure session resumption is disabled:
+
+```erlang
+{reuse_sessions, false}
+```
+This eliminates the Triple Handshake attack surface at the cost of a
+full handshake for every connection. For deployments that need both
+mutual authentication and session resumption over TLS 1.2, upgrading
+to TLS 1.3 is the recommended solution — TLS 1.3 session tickets are
+inherently safe.
+
+Note that this concern only applies to the server role. A client
+setting `verify_peer` to verify the server is not affected.
+
+The default value for `reuse_sessions` in above described configuration
+is false since OTP @OTP-20289@
+
+
 ### Key Exchange Groups
 TLS-1.3 decouples key exchange algorithms from cipher suites. The key
 exchange algorithms are configured using the

lib/ssl/src/ssl_config.erl

@@ -1388,7 +1388,16 @@ opt_reuse_sessions(UserOpts, #{versions := Versions} = Opts, #{role := client})
     assert_version_dep(Where2 =:= new, reuse_session, Versions, ['tlsv1','tlsv1.1','tlsv1.2']),
     Opts#{reuse_sessions => RUSS, reuse_session => RS};
 opt_reuse_sessions(UserOpts, #{versions := Versions} = Opts, #{role := server}) ->
-    {Where1, RUSS} = get_opt_bool(reuse_sessions, true, UserOpts, Opts),
+    %% Disable reuse_sessions when client cert verify_peer
+    %% verification is required, until Extended Master Secret is implemented.
+    ReuseDefault = case maps:get(verify, Opts) of
+                       verify_peer ->
+                           false;
+                       verify_none ->
+                           true
+                   end,
+
+    {Where1, RUSS} = get_opt_bool(reuse_sessions, ReuseDefault, UserOpts, Opts),
 
     DefRS = fun(_, _, _, _) -> true end,
     {Where2, RS} = get_opt_fun(reuse_session, 4, DefRS, UserOpts, Opts),

lib/ssl/test/ssl_session_SUITE.erl

@@ -186,7 +186,7 @@ reuse_session(Config) when is_list(Config) ->
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     Version = ssl_test_lib:protocol_version(Config),
     ssl_test_lib:reuse_session([{versions,[Version]} | ClientOpts],
-                               [{versions,[Version]} | ServerOpts], Config).
+                               [{reuse_sessions, true},{versions,[Version]} | ServerOpts], Config).
 %%--------------------------------------------------------------------
 reuse_session_expired() ->
     [{doc,"Test sessions is not reused when it has expired"}].
@@ -206,7 +206,7 @@ reuse_session_expired(Config) when is_list(Config) ->
 				   {from, self()},
 				   {mfa, {ssl_test_lib, no_result, []}},
 				   {tcp_options, [{active, false}]},
-				   {options, ServerOpts}]),
+                                   {options, [{reuse_sessions, true}| ServerOpts]}]),
     Port0 = ssl_test_lib:inet_port(Server0),
 
     Client0 = ssl_test_lib:start_client([{node, ClientNode},
@@ -338,7 +338,7 @@ explicit_session_reuse(Config) when is_list(Config) ->
 	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
                                    {from, self()},
                                    {mfa, {ssl_test_lib, no_result, []}},
-                                   {options, ServerOpts}]),
+                                   {options, [{reuse_sessions, true} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     {Client0, Client0Sock} =
 	ssl_test_lib:start_client([{node, ClientNode},
@@ -491,7 +491,7 @@ no_reuses_session_server_restart_new_cert() ->
     [{doc,"Check that a session is not reused if the server is restarted with a new cert."}].
 no_reuses_session_server_restart_new_cert(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_der_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_rsa_der_verify_opts, Config),
+    ServerOpts = [[{reuse_sessions, true} | ssl_test_lib:ssl_options(server_rsa_der_verify_opts, Config)],
     POpts = proplists:get_value(group_opts, Config, []),
 
     #{client_config := NewCOpts,
@@ -620,7 +620,8 @@ client_max_session_table(Config) when is_list(Config)->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, HostName} = ssl_test_lib:run_where(Config),
-    test_max_session_limit(ClientOpts,ServerOpts,ClientNode, ServerNode, HostName),
+    test_max_session_limit(ClientOpts,[{reuse_sessions, true} | ServerOpts],
+                           ClientNode, ServerNode, HostName),
     %% Explicit check table size
     {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
     [_, _,_, _, Prop] = StatusInfo,
@@ -635,7 +636,8 @@ server_max_session_table(Config) when is_list(Config)->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, HostName} = ssl_test_lib:run_where(Config),
-    test_max_session_limit(ClientOpts,ServerOpts,ClientNode, ServerNode, HostName),
+    test_max_session_limit(ClientOpts,[{reuse_sessions, true} | ServerOpts],
+                           ClientNode, ServerNode, HostName),
     %% Explicit check table size
     SupName = sup_name(ServerOpts),
     Sup = whereis(SupName),