upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-02 13:30:44 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/doc/man
History
Artem Boldariev c759f25c7b Add "session-tickets" options to the "tls" clause 
This commit adds the ability to enable or disable stateless TLS
session resumption tickets (see RFC5077). Having this ability is
twofold.

Firstly, these tickets are encrypted by the server, and the algorithm
might be weaker than the algorithm negotiated during the TLS session
establishment (it is in general the case for TLSv1.2, but the generic
principle applies to TLSv1.3 as well, despite it having better ciphers
for session tickets). Thus, they might compromise Perfect Forward
Secrecy.

Secondly, disabling it might be necessary if the same TLS key/cert
pair is supposed to be used by multiple servers to achieve, e.g., load
balancing because the session ticket by default gets generated in
runtime, while to achieve successful session resumption ability, in
this case, would have required using a shared key.

The proper alternative to having the ability to disable stateless TLS
session resumption tickets is to implement a proper session tickets
key rollover mechanism so that key rotation might be performed
often (e.g. once an hour) to not compromise forward secrecy while
retaining the associated performance benefits. That is much more work,
though. On the other hand, having the ability to disable session
tickets allows having a deployable configuration right now in the
cases when either forward secrecy is wanted or sharing the TLS
key/cert pair between multiple servers is needed (or both).
2021-10-01 15:50:43 +03:00
..
.gitignore Convert the documentation to Sphinx documentation format 2020-05-07 16:02:56 +02:00
arpaname.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
arpaname.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
conf.py Remove redundant prefix from Python 3 strings 2021-09-16 08:22:01 +02:00
ddns-confgen.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
ddns-confgen.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
delv.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
delv.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dig.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dig.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-cds.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-cds.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-dsfromkey.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-dsfromkey.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-importkey.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-importkey.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-keyfromlabel.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-keyfromlabel.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-keygen.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-keygen.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-revoke.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-revoke.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-settime.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-settime.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-signzone.1in Remove the mastefile-format map option 2021-09-17 07:09:50 +02:00
dnssec-signzone.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnssec-verify.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnssec-verify.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
dnstap-read.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
dnstap-read.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
filter-a.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
filter-a.rst Add filter-a plugin for IPv6-dominant environments 2021-03-19 08:06:55 +01:00
filter-aaaa.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
filter-aaaa.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
host.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
host.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
index.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
Makefile.am Remove native PKCS#11 support 2021-09-09 15:35:39 +02:00
mdig.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
mdig.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named-checkconf.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
named-checkconf.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named-checkzone.1in Remove the mastefile-format map option 2021-09-17 07:09:50 +02:00
named-checkzone.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named-compilezone.1in Remove the mastefile-format map option 2021-09-17 07:09:50 +02:00
named-compilezone.rst Install man page for named-compilezone 2021-03-22 09:36:48 +01:00
named-journalprint.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
named-journalprint.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named-nzd2nzf.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
named-nzd2nzf.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named-rrchecker.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
named-rrchecker.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
named.conf.5in Add "session-tickets" options to the "tls" clause 2021-10-01 15:50:43 +03:00
named.conf.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
named.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
nsec3hash.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
nsec3hash.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
nslookup.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
nslookup.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
nsupdate.1in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
nsupdate.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
rndc-confgen.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
rndc-confgen.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
rndc.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
rndc.conf.5in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
rndc.conf.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
rndc.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00
tsig-keygen.8in Regenerate man pages with docutils 0.17.1 2021-09-16 10:57:04 +02:00
tsig-keygen.rst update all copyright headers to eliminate the typo 2020-09-14 16:20:40 -07:00