SSL_CTX_SET_TLSEXT_TICKET_KEY_CB(3ssl) OpenSSL SSL_CTX_set_tlsext_ticket_key_evp_cb, SSL_CTX_set_tlsext_ticket_key_cb - #include int SSL_CTX_set_tlsext_ticket_key_evp_cb(SSL_CTX sslctx, int (*cb)(SSL *s, unsigned char key_name[16], unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx, EVP_MAC_CTX *hctx, int enc)); OpenSSL 3.0 OPENSSL_API_COMPAT openssl_user_macros(7): int SSL_CTX_set_tlsext_ticket_key_cb(SSL_CTX sslctx, int (*cb)(SSL *s, unsigned char key_name[16], unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)); SSL_CTX_set_tlsext_ticket_key_evp_cb() cb SSL sslctx. RFC5077 . TLS SSLv3. cb TLS TLS. . OpenSSL TLS 4 RFC5077 . TLS . . TLS . ctx hctx EVP_CIPHER_CTX_reset(3) EVP_MAC_CTX_new(3) . enc 1. OpenSSL name iv ctx hctx. name 16 . iv IV . IV EVP_MAX_IV_LENGTH . iv . ctx iv. EVP_EncryptInit_ex(3). HMAC EVP_MAC_CTX_set_params(3) OSSL_MAC_PARAM_KEY OSSL_MAC_PARAM_DIGEST . enc 0 cb . name iv . OpenSSL name ctx iv EVP_DecryptInit_ex(3). hctx EVP_MAC_CTX_set_params(3) OSSL_MAC_PARAM_KEY OSSL_MAC_PARAM_DIGEST . name 2. enc 1 . cb OpenSSL . : 2 ctx hctx . . OpenSSL cb enc 1 ( RFC5077 3.3 2). 1 ctx hctx . 0 / SSL/TLS SSL/TLS . enc 0 cb . 0 . SSL_CTX_set_tlsext_ticket_key_cb() SSL_CTX_set_tlsext_ticket_key_evp_cb() HMAC_CTX EVP_MAC_CTX. hctx EVP_MAC_CTX_new(3) EVP_MAC_CTX_set_params(3). hctx HMAC_Init_ex(3). TLS . . . : . . . 256 128 128 . 1 0 . : SSL_CTX_set_tlsext_ticket_key_evp_cb(SSL, ssl_tlsext_ticket_key_cb); ... static int ssl_tlsext_ticket_key_cb(SSL *s, unsigned char key_name[16], unsigned char *iv, EVP_CIPHER_CTX *ctx, EVP_MAC_CTX *hctx, int enc) { OSSL_PARAM params[3]; your_type_t *key; /* something that you need to implement */ if (enc) { /* create new session */ if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0) return -1; /* insufficient random */ key = currentkey(); /* something that you need to implement */ if (key == NULL) { /* current key doesn't exist or isn't valid */ key = createkey(); /* * Something that you need to implement. * createkey needs to initialise a name, * an aes_key, a hmac_key and optionally * an expire time. */ if (key == NULL) /* key couldn't be created */ return 0; } memcpy(key_name, key->name, 16); if (EVP_EncryptInit_ex(&ctx, EVP_aes_256_cbc(), NULL, key->aes_key, iv) == 0) return -1; /* error in cipher initialisation */ params[0] = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, key->hmac_key, 32); params[1] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); params[2] = OSSL_PARAM_construct_end(); if (EVP_MAC_CTX_set_params(hctx, params) == 0) return -1; /* error in mac initialisation */ return 1; } else { /* retrieve session */ time_t t = time(NULL); key = findkey(key_name); /* something that you need to implement */ if (key == NULL || key->expire < t) return 0; params[0] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, key->hmac_key, 32); params[1] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); params[2] = OSSL_PARAM_construct_end(); if (EVP_MAC_CTX_set_params(hctx, params) == 0) return -1; /* error in mac initialisation */ if (EVP_DecryptInit_ex(&ctx, EVP_aes_256_cbc(), NULL, key->aes_key, iv) == 0) return -1; /* error in cipher initialisation */ if (key->expire < t - RENEW_TIME) { /* RENEW_TIME: implement */ /* * return 2 - This session will get a new ticket even though the * current one is still valid. */ return 2; } return 1; } } ssl(7), SSL_set_session(3), SSL_session_reused(3), SSL_CTX_add_session(3), SSL_CTX_sess_number(3), SSL_CTX_sess_set_get_cb(3), SSL_CTX_set_session_id_context(3), SSL_CTX_set_tlsext_ticket_key_cb() OpenSSL 3.0. SSL_CTX_set_tlsext_ticket_key_evp_cb() OpenSSL 3.0. 2014-2024 OpenSSL. . Apache 2.0 ( ""). . LICENSE . 3 . . : . 3.6.2 7 2026 SSL_CTX_SET_TLSEXT_TICKET_KEY_CB(3ssl)