---
_id: '52251'
abstract:
- lang: eng
  text: Session tickets are a resumption mechanism, which can speed up repeated TLS
    connections. To do so, information is stored client-side, encrypted with an additional
    symmetric key, which is separate from existing private keys. A server only has
    to store this key, making session tickets stateless for the server. If the key
    is shared between servers, a client can be misled into resuming a session with
    a different, less secure server. In this thesis, we design and implement a scan
    for detecting prerequisites to such an attack, by requesting and redeeming tickets
    for pair-wise servers. We find that 17,901 out of 22,127 scanned (virtual) hosts
    are potentially vulnerable to this attack because they share their keys and accept
    tickets issued for other domains. We discuss the difficulties of detecting such
    an attack and show that unfortunately, our approach does not scale to larger sample
    sizes.
author:
- first_name: Tim Leonhard
  full_name: Storm, Tim Leonhard
  id: '74914'
  last_name: Storm
citation:
  ama: Storm TL. <i>Large Scale Scanning of TLS Session Ticket Confusion</i>.; 2023.
    doi:<a href="https://doi.org/10.17619/UNIPB/1-1770 ">10.17619/UNIPB/1-1770 </a>
  apa: Storm, T. L. (2023). <i>Large Scale Scanning of TLS Session Ticket Confusion</i>.
    <a href="https://doi.org/10.17619/UNIPB/1-1770 ">https://doi.org/10.17619/UNIPB/1-1770
    </a>
  bibtex: '@book{Storm_2023, title={Large Scale Scanning of TLS Session Ticket Confusion},
    DOI={<a href="https://doi.org/10.17619/UNIPB/1-1770 ">10.17619/UNIPB/1-1770 </a>},
    author={Storm, Tim Leonhard}, year={2023} }'
  chicago: Storm, Tim Leonhard. <i>Large Scale Scanning of TLS Session Ticket Confusion</i>,
    2023. <a href="https://doi.org/10.17619/UNIPB/1-1770 ">https://doi.org/10.17619/UNIPB/1-1770
    </a>.
  ieee: T. L. Storm, <i>Large Scale Scanning of TLS Session Ticket Confusion</i>.
    2023.
  mla: Storm, Tim Leonhard. <i>Large Scale Scanning of TLS Session Ticket Confusion</i>.
    2023, doi:<a href="https://doi.org/10.17619/UNIPB/1-1770 ">10.17619/UNIPB/1-1770
    </a>.
  short: T.L. Storm, Large Scale Scanning of TLS Session Ticket Confusion, 2023.
date_created: 2024-03-04T13:37:31Z
date_updated: 2024-03-04T13:42:33Z
ddc:
- '006'
doi: '10.17619/UNIPB/1-1770 '
file:
- access_level: open_access
  content_type: application/pdf
  creator: tistorm
  date_created: 2024-03-04T13:36:14Z
  date_updated: 2024-03-04T13:38:38Z
  file_id: '52253'
  file_name: BT_Tim_Storm_14_05_23_signed.pdf
  file_size: 1577963
  relation: main_file
file_date_updated: 2024-03-04T13:38:38Z
has_accepted_license: '1'
language:
- iso: eng
oa: '1'
page: '54'
status: public
supervisor:
- first_name: Juraj
  full_name: Somorovsky, Juraj
  id: '83504'
  last_name: Somorovsky
  orcid: 0000-0002-3593-7720
- first_name: Sven Niclas
  full_name: Hebrok, Sven Niclas
  id: '55616'
  last_name: Hebrok
  orcid: 0009-0006-1172-1665
title: Large Scale Scanning of TLS Session Ticket Confusion
type: bachelorsthesis
user_id: '74914'
year: '2023'
...