1

I am trying to figure out if TOR is implementing session resumption or not. Last open discussion I found was this one: https://gitlab.torproject.org/legacy/trac/-/issues/17252 which seems to say that it is enabled.

However, TOR's ClientHello messages do not support most of the extensions required to do session resumption (session_ticket and psk_key_exchange_modes in particular, though key_exchange is there). What is the current status on session resumption? I'd bet disabled, but then I am wondering why that decision was made, based on the last thread I found?

Thanks a lot for your help!

Improve this question

1 Answer 1

Reset to default
1

In the past, the Tor browser used to block TLS session resumption entirely because it could fingerprint users. However, the Tor browser now isolates TLS session resumption to the URL and re-enables it.

This issue which was asking to bind TLS session resumption to the URL has now been closed as the Tor browser has now been configured to do this.

enter image description here

I hope this answers your question!

Improve this answer
1
  • 1
    The issue is the same as the one I added in my initial post, and as you said it seems like it is configured to support session resumption. But as explained, when checking the outgoing ClientHello packets, none of the required extension are present, which makes me think it is no longer the case, but I might be wrong.
    – manolia
    Apr 23, 2021 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.