TLS Session Tickets

[colmmacc]

s2n should support TLS tickets for session re-use. We should take care to ensure that TLS tickets may only be re-used when all of the TLS negotiation parameters match (e.g. SNI field ... etc). Perhaps use NaCL for encrypting the ticket.

[colmmacc]

A note on this one: to support large multi-host environments we'll want to support the application providing the encryption key for the tickets, but how do we encourage applications to rotate the TLS session key frequently?

[baldwinmatt]

we can provide an API to rotate a key, which takes a grace period lifetime as a parameter for which to keep the old key available to decrypt current tickets, potentially.

we could also make the api to set the key take a lifetime parameter, after which the key is no longer used, so unless the application provides a new key, tickets will stop working

[xonatius]

Closing, as #785 is merged now.