TLS Stateful vs Stateless Session Resumption

1. Preliminary Information

TLS Session Resumption allows caching of TLS session information.

There are 2 kinds: stateful and stateless.

In stateful session resumption, BIG-IP stores TLS session information locally.

In stateless session resumption, such job is delegated to the client.

BIG-IP supports both stateful and stateless TLS session resumption.

Enabling stateful or stateless session resumption is just a matter of ticking/unticking a tickbox on LTM's Client SSL profile:

In this article, I'm going to walk through how session resumption works by performing a lab test.

Here's my topology:

Do not confuse Session Reuse/Resumption with Renegotiation. Renegotiation uses the same TCP connection to renegotiate security parameters which does not involved Session ID or Session Tickets. For more information please refer to SSL Legacy Renegotiation Secure Renegotiation.

2. How Stateful Session Resumption works

Capture used: ssl-sample-session-ticket-disabled.pcap

2.1 New session

Stateful means BIG-IP will keep storing session information from as many clients its cache allows and TLS handshake will proceed as follows:

We can see above that Client sends an empty Session ID field and BIG-IP replies with a new Session ID (filter used: tcp.stream eq 0).

After that, full handshake proceeds normally where Certificate and Client Key Exchange are sent and there is also the additional cost CPU-wise to compute the keys:

2.2 Reusing Previous Session

Now both Client and Server have Session ID 56bcf9f6ea40ac1bbf05ff7fd209d423da9f96404103226c7f927ad7a2992433 stored in their TLS session cache.

The good thing about it is that in the next TLS connection request, client won't need to go through the full TLS handshake again.

Here's what we see:

Client just sends Session ID (56bcf9f6ea40ac1bbf05ff7fd209d423da9f96404103226c7f927ad7a2992433) it previously learnt from BIG-IP (via Server Hello from previous connection) on its Client Hello message. BIG-IP then confirms this session ID is in its SSL Session cache and they both go through what is known as abbreviated TLS handshake. No certificate or key information is exchanged during abbreviated TLS handshake and previously negotiated keys are re-used.

3. How Stateless Session Resumption works

Capture used: ssl-sample-session-ticket-enabled-2.pcap

3.1 New Session

Because of the burden on BIG-IP that has to store one session per client, RFC5077 suggested a new way of doing session Resumption that offloads the burden of keeping all TLS session information to client and nothing else needs to be stored on BIG-IP.

Let's see the magic!

Client first signals it supports stateless session resumption by adding SessionTickets TLS extension to its Client Hello message (in green):

BIG-IP also signals back to client (in red) it supports SessionTicket TLS by adding empty SessionTicket TLS extension. Notice that Session ID is NOT used here!

The TLS handshake proceeds normally just like in stateful session resumption. However, just before handshake is completed (with Finished message), BIG-IP sends a new TLS message called New Session Ticket which consists of encrypted session information (e.g. master secret, cipher used, etc) where BIG-IP is able to decrypt later using a unique key it generates only for this purpose:

From this point on, client (10.199.3.135) keeps session ticket in its TLS cache until next time it needs to connect to the same server (assuming session ticket did not expire).

3.2 Reusing Previous Session

Now, when the same client wants to re-use previous session, it forwards the same session ticket above in SessionTicket TLS extension on its Client Hello message as seen below:

As we've noticed, Client also creates a new Session ID used for the following purpose:

• Server replies back with same session ID: BIG-IP accepted Session Ticket and is going to reuse the session. 
• Server replies with empty/different Session ID: BIG-IP decided to go through full handshake either because Session Ticket expired or it is falling back to stateful session resumption.

PS: Such session ID is NOT stored on BIG-IP otherwise it would defeat the purpose of stateless session reuse. It is a one-off usage just to confirm to client BIG-IP accepted session ticket they sent and we're not going to generate new session keys.

In our example, BIG-IP successfully accepted and reused TLS session. We can confirm that an abbreviated TLS handshake took place and on Server Hello message BIG-IP replied back with same session ID client sent (to BIG-IP):

Now, client

This is session resumption in action and BIG-IP doesn't even have to store session information locally, making it a more scalable option when compared to stateful session resumption.