Skip to content

TLS 1.3 early data: ssl-opt.sh tests with GnuTLS and MbedTLS #6362

@ronald-cron-arm

Description

@ronald-cron-arm

The goal of this issue is to finalize the testing of the TLS 1.3 early data feature in ssl-opt.sh.

Current status:
Various tests with GnuTLS as a peer, client or server.
No test against OpenSSL but even in 3.x versions there does not seem to be support for it associated with re-connection using a ticket. As we support early data only with tickets, there is no way to test against OpenSSL in ssl-opt.sh without adding a new way of running tests in ssl-opt.sh. Not planned to do it yet, just GnuTLS as third party TLS 1.3 client/server for now.

Tasks:

  • Clean-up of current early data tests against GnuTLS (check for redundancy and consistency, group them if this is not already the case).
  • Add negative testing regarding setting of the peers: early data enabled in one peer but not in the other, early data enabled but the handshake go through sending an HRR.
  • Add tests with MbedTLS as client and server
  • Add a negative test where a client try to send early data associated with a pre-shared key (not a ticket). We support eraly data only with tickets. Not sure if this is possible.
  • Be sure TLS 1.3: Add mbedtls_ssl_write_early_data() API #8760 (comment) is addressed.

Metadata

Metadata

Type

No type

Projects

Status

[3.6] TLS 1.3 early data

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions