The Backend Engineering Show with Hussein Nasser cover image

The Cloudflare mTLS vulnerability - A Deep Dive Analysis

The Backend Engineering Show with Hussein Nasser

00:00

How to Decrypt a Session Ticket

All what the client does is they do a client hello and they send everything in the client hello. The second recession ticket inside the client hello says, Hey, hey, server, last time you remember you should give me that. I want to resume a session. And now we might say, like there is a main secret that's associated with that, the client knows, but the client never sends that secret on plain text. Right? But since this encrypted session, which is also pointless, even the client cannot declare that, but the server can. So the client, the server gets that session ticket, decrypts it, right? With that key, the key must exist in the server

Transcript
Play full episode

Remember Everything You Learn from Podcasts

Save insights instantly, chat with episodes, and build lasting knowledge - all powered by AI.
App store bannerPlay store banner