Re: [quicwg/base-drafts] Allow most frames in 0-RTT (#2355)

[MikkelFJ <[e-mail]>]

mikkelfj commented on this pull request.



> +Processing of QUIC frames is idempotent and cannot result in invalid connection
+states if frames are replayed, reordered or lost.  QUIC connections do not
+produce effects that last beyond the lifetime of the connection, except for
+those produced by the application protocol that QUIC serves.
+
+Note:
+
+: TLS session tickets and address validation tokens are used to carry QUIC
+  configuration information between connections.  These MUST NOT be used to
+  carry application state.  The potential for reuse of these tokens means that
+  they require stronger protections against replay.
+
+A server that accepts 0-RTT on a connection incurs a higher cost than accepting
+a connection without 0-RTT.  This includes higher processing and computation
+costs.  Servers need to consider the probability of replay and all associated
+costs when accepting 0-RTT.

With that argument a client might as well use 1-RTT connections and make the server pay for Diffie-Helmann exchanges in addition to buffering. What makes 0-RTT costly is the ease with which the server can be made to pay that cost. 0-RTT is expensive because it is cheap for the client to incur th expense on the server.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2355#discussion_r263581704