From 05df5c2036f1244fe3df70de7d8079a5d86b999d Mon Sep 17 00:00:00 2001 From: TJ Saunders Date: Sat, 27 Feb 2016 19:37:34 +0100 Subject: Use AES256 for the default encryption algoritm for TLS session tickets This involves providing more session ticket key data, for both the cipher and the digest Signed-off-by: Kurt Roeckx Reviewed-by: Matt Caswell GH: #515, MR: #2153 --- ssl/ssl_locl.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'ssl/ssl_locl.h') diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 9bc9892e2c..b39f387483 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -858,8 +858,8 @@ struct ssl_ctx_st { void *tlsext_servername_arg; /* RFC 4507 session ticket keys */ unsigned char tlsext_tick_key_name[16]; - unsigned char tlsext_tick_hmac_key[16]; - unsigned char tlsext_tick_aes_key[16]; + unsigned char tlsext_tick_hmac_key[32]; + unsigned char tlsext_tick_aes_key[32]; /* Callback to support customisation of ticket key setting */ int (*tlsext_ticket_key_cb) (SSL *ssl, unsigned char *name, unsigned char *iv, -- cgit v1.2.3