Re: [TLS] 0-RTT and Anti-Replay

[Martin Thomson <[e-mail]>]

On 22 March 2015 at 22:21, Colm MacCárthaigh <[e-mail]> wrote:
> It's probably easier than rebooting in a real-world attack: the server
> is vulnerable to state exhaustion attacks. For a primitive server, an
> attacker can generate enough client randoms to exhaust the state
> capabilities of the remote end. A more complicated server set-up might
> use a distributed store, sharded on the client random data; but even
> if they pay enough attention to use a salted hash of the client random
> data for the shard key, it only changes the attack effort by a linear
> factor.

Well, Adam described at the interim why this isn't a concern: as the
"strike register" takes a higher density of entries, the window of
time over which it applies can be narrowed to limit the potential for
state exhaustion.  That simply increases the likelihood of a
rejection, not the attack.