VD
Viktor Dukhovni
— On the schedule —
TLS 1.3, session resumption, 0-RTT early data, external PSKs and all that...
TLS 1.3 combined session resumption and key exchange via external pre-shared keys into a single PSK mechanism and then further overloaded it with 0-RTT (early data) support and overlap with ECH. The result is a rather complex feature, that can be difficult to understand, implement and use, with some non-obvious limitations, in part addressed by RFC9258 (expected to land in OpenSSL 4.1). This complexity meant that before implementing RFC9258 a number of subtle bugs had to be fixed first in both the upcoming 4.1 branch and the stable releases. The talk will demystify the protocol and cover the associated OpenSSL APIs old and new.
— Compositor's note —
Contributor to Postfix since 2001, primary maintainer of its TLS stack. Active user of OpenSSL since ~2006. Active contributor to OpenSSL since 2016, in particular author of OpenSSL DANE support with a general focus on the X.509 verification code and its use in TLS. Member of OpenSSL OMC from ~2016-2019. More recently actively contributed to the integration of ML-KEM and ML-DSA into OpenSSL 3.5. Other technical areas of expertise include SMTP email and DNS.