Internal changes in preparation for key rotation
- two sets of keys
- separate function for key generation/update
diff --git a/include/mbedtls/ssl_ticket.h b/include/mbedtls/ssl_ticket.h
index 3612a92..201849e 100644
--- a/include/mbedtls/ssl_ticket.h
+++ b/include/mbedtls/ssl_ticket.h
@@ -36,12 +36,22 @@
#endif
/**
+ * \brief Information for session ticket protection
+ */
+typedef struct
+{
+ unsigned char name[4]; /*!< random key identifier */
+ uint32_t generation_time; /*!< key generation timestamp (seconds) */
+ mbedtls_cipher_context_t ctx; /*!< context for auth enc/decryption */
+}
+mbedtls_ssl_ticket_key;
+
+/**
* \brief Context for session ticket handling functions
*/
typedef struct
{
- unsigned char key_name[4]; /*!< name to quickly reject bad tickets */
- mbedtls_cipher_context_t cipher;/*!< cipher context */
+ mbedtls_ssl_ticket_key keys[2]; /*!< ticket protection keys */
uint32_t ticket_lifetime; /*!< lifetime of tickets in seconds */