Session Resumption (PSK)

After a successful handshake, server can issue a NewSessionTicket containing a pre-shared key (PSK) the client can use to resume the connection later — much faster than a full handshake.

struct NewSessionTicket {
    ticket_lifetime (4 bytes seconds)
    ticket_age_add (4 bytes random)
    ticket_nonce (variable)
    ticket (variable — opaque blob)
    extensions
}

The ticket may be:

• An encrypted cookie containing the PSK (server is stateless).
• A handle into server-side cache (server is stateful).

On reconnect, client sends:

ClientHello + pre_shared_key extension (with ticket + binder)

The binder is HMAC over the ClientHello, proving possession of the PSK without revealing it.

Server validates binder; if good, derives keys from the PSK without DH (or with optional DH for forward secrecy).

0-RTT mode:

• Client can send application data IMMEDIATELY in ClientHello (before server replies!).
• Encrypted with early-data key derived from PSK.
• Saves 1 round-trip — same-region resumption can be near-zero latency.

Catch: 0-RTT data has weaker security:

• Replayable: an attacker can resend the same encrypted data later. Server has no way to detect.
• Use only for idempotent requests (GET, not state-mutating writes).
• Apps must explicitly opt in.

Servers should also rotate ticket keys periodically (for forward secrecy if the ticket key leaks). Common: rotate every few hours.