79102377

Date: 2024-10-18 13:59:17
Score: 0.5
Natty:
Report link

The reason why the callback is not called is that the Server Hello itself had an issue and the openSSL has not calculated any secrets so far.

And the reason for failure is that the client hello sent valid session_id whereas server hello had carried session_id=0 due which the Illegal parameter error was thrown by the client.

As per section 4.1.3 in RFC 8446, If the client hello had session_id, then the server hello must echo back the session_id.

legacy_session_id_echo:  The contents of the client's
      legacy_session_id field.  Note that this field is echoed even if
      the client's value corresponded to a cached pre-TLS 1.3 session
      which the server has chosen not to resume.  A client which
      receives a legacy_session_id_echo field that does not match what
      it sent in the ClientHello MUST abort the handshake with an
      "illegal_parameter" alert.

Thanks, Prakash

Reasons:
  • Blacklisted phrase (0.5): Thanks
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Self-answer (0.5):
  • Low reputation (0.5):
Posted by: Prakash GiBBs