tech · quantum risk

Is TLS session resumption Quantum Proof? Network Security & PQC

Risk: medium · Confidence: high · Reviewed: 2026-07-19

Verdict

Session resumption does not make TLS quantum-proof. If the original handshake was classical-only, recorded sessions remain HNDL-relevant; ticket key compromise is a separate classical operational risk.

Overview

TLS session tickets and PSK resumption improve performance by avoiding full handshakes.

Quantum migration still focuses on full handshake KEMs. Resumption inherits the security of prior key material and ticket protection.

Rotate ticket keys frequently; do not treat 0-RTT as a quantum control.

Cryptographic profile

Signatures: Session ticket encryption keys (symmetric), Prior handshake still set master secrets
Hash: TLS
Public-key exposure: Ticket keys are high-value symmetric secrets; original handshakes may still be classical.

What breaks

Long-lived session ticket keys
Assuming resumption bypasses PQC needs
0-RTT replay issues (classical app risk)

Mitigations

Short ticket key lifetimes
Hybrid full handshakes when establishing sessions
Disable 0-RTT where replay is unacceptable

FAQ

Are session tickets post-quantum?

Tickets use symmetric crypto; the initial key exchange algorithm still dominates quantum story.

Disable resumption for quantum safety?

Not required; prioritize hybrid handshakes and ticket key hygiene.

Key concepts (technical dictionary)

Terms used on this page — open a definition:

Full technical dictionary →