wolfSSL 5.6.6 introduces the option for DTLS 1.3 servers to skip the cookie exchange on a session resumption. The cookie exchange is a security mechanism employed during the resumption of a DTLS 1.3 session. When a client wants to resume a previous DTLS 1.3 session, it sends a session ticket to the server, which may respond by issuing a “cookie” to the client. This cookie serves as a challenge-response mechanism, requiring the client to present it during the resumption attempt. The purpose of this exchange is for the client to demonstrate reachability at their apparent network address. In some cases, you may choose to skip the cookie exchange if the client presents a valid ticket or pre-shared key (PSK).
To resume a DTLS 1.3 session without the cookie exchange:
- Compile wolfSSL with WOLFSSL_DTLS13_NO_HRR_ON_RESUME defined. Either:
- When compiling with configure add CPPFLAGS=-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME
- When compiling with user settings add #define WOLFSSL_DTLS13_NO_HRR_ON_RESUME
- Call wolfSSL_dtls13_no_hrr_on_resume(ssl, 1) on the WOLFSSL object to disable the cookie exchange on resumption
- Continue like with a normal connection
If you have any questions about using DTLS 1.3 in wolfSSL, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now