<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div></div>
<div data-ogsc="" style="">
<div>Hello,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">The change seems reasonable, but should there maybe a method to refresh temporary keys used for those session tokens - I.e. "invalidate all" and link to that so specific implementations are encourages to offer such an API.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Gruss</div>
<div dir="ltr">Bernd</div>
<div class="ms-outlook-ios-signature" id="ms-outlook-mobile-signature">
<div style="direction: ltr;">-- </div>
<div style="direction: ltr;">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> security-dev <security-dev-bounces@openjdk.java.net> im Auftrag von Anthony Scarpino <anthony.scarpino@oracle.com><br>
<b>Gesendet:</b> Tuesday, June 16, 2020 2:42:32 AM<br>
<b>An:</b> OpenJDK Security <security-dev@openjdk.java.net><br>
<b>Betreff:</b> Re: [RFR] 8229148: SSLSession.invalidate() does not invalidate stateless tickets</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">The specifications for TLS 1.3 (RFC 8446) and Stateless Resumption for
<br>
TLS 1.2 (RFC 5077) does not define session invalidation. Additionally, <br>
RFC 5077 provides research that it is unnecessary. This change is to <br>
clarify that session invalidation method in the Java API, in <br>
javax.net.ssl.SSLSession.invalidate(), may not be supported in some <br>
circumstances.<br>
<br>
The CSR is: <a href="https://bugs.openjdk.java.net/browse/JDK-8243678">https://bugs.openjdk.java.net/browse/JDK-8243678</a><br>
The webrev is inline:<br>
<br>
src/java.base/share/classes/javax/net/ssl/SSLSession.java<br>
@@ -129,6 +129,12 @@<br>
* using this session can continue to use the session until the<br>
* connection is closed.<br>
*<br>
+ * @apiNote<br>
+ * This operation is optional as the implementation may not support<br>
+ * session invalidation. This could occur with implementations of<br>
+ * Stateless Resumption (RFC 5077) and/or TLS 1.3 (RFC 8446) which<br>
+ * do not specify session invalidation.<br>
+ *<br>
* @see #isValid()<br>
*/<br>
public void invalidate();<br>
</div>
</span></font></div>
</body>
</html>