tor/changes/bug7139

  o Major bugfixes (security):

    - Disable TLS session tickets.  OpenSSL's implementation were giving
      our TLS session keys the lifetime of our TLS context objects, when
      perfect forward secrecy would want us to discard anything that
      could decrypt a link connection as soon as the link connection was
      closed.  Fixes bug 7139; bugfix on all versions of Tor linked
      against OpenSSL 1.0.0 or later. Found by "nextgens".
Disable TLS Session Tickets, which we were apparently getting for free OpenSSL 1.0.0 added an implementation of TLS session tickets, a "feature" that let session resumption occur without server-side state by giving clients an encrypted "ticket" that the client could present later to get the session going again with the same keys as before. OpenSSL was giving the keys to decrypt these tickets the lifetime of the SSL contexts, which would have been terrible for PFS if we had long-lived SSL contexts. Fortunately, we don't. Still, it's pretty bad. We should also drop these, since our use of the extension stands out with our non-use of session cacheing. Found by nextgens. Bugfix on all versions of Tor when built with openssl 1.0.0 or later. Fixes bug 7139. 2012-10-18 01:57:27 +02:00			`o Major bugfixes (security):`

			`- Disable TLS session tickets. OpenSSL's implementation were giving`
			`our TLS session keys the lifetime of our TLS context objects, when`
			`perfect forward secrecy would want us to discard anything that`
			`could decrypt a link connection as soon as the link connection was`
			`closed. Fixes bug 7139; bugfix on all versions of Tor linked`
			`against OpenSSL 1.0.0 or later. Found by "nextgens".`