Changeset 9a26df9 in mod_gnutls for CHANGELOG

Timestamp:

Jun 24, 2020, 3:28:12 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master

Children:

3e7427a

Parents:

8d0efdc

Message:

Update Changelog

File:

• CHANGELOG (modified) (1 diff)

CHANGELOG

@@ -16 +16 @@
   connections (TLS 1.3 connections only).
 
+- Disable session tickets by default. The GnuTLS built-in key rotation
+  for session tickets never actually changes the primary key, just
+  derives keys from it, so it does not provide forward secrecy in case
+  an attacker learns the primary key (by gaining access to server
+  RAM). A reload of the server is enough to generate a new key, so
+  consider enabling session tickets and reloading the server every few
+  hours, at least until a forward-secret rotation can be implemented.
+
 - Add ./configure option to disable building PDF documentation
+
+- Deprecate SRP and disable it by default.
 
 ** Version 0.10.0 (2020-02-03)