Re: [TLS] 0-RTT (Was: Re: 0-RTT and Anti-Replay)

Daniel Kahn Gillmor <> Mon, 13 April 2015 20:59 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 8CA071A7113 for <>; Mon, 13 Apr 2015 13:59:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id K4F0LklDxV9f for <>; Mon, 13 Apr 2015 13:59:56 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 2C7831A710D for <>; Mon, 13 Apr 2015 13:59:56 -0700 (PDT)
Received: from (unknown []) by (Postfix) with ESMTPSA id 49FAFF984 for <>; Mon, 13 Apr 2015 16:59:54 -0400 (EDT)
Received: by (Postfix, from userid 1000) id 3FBA420088; Mon, 13 Apr 2015 15:59:53 -0500 (CDT)
From: Daniel Kahn Gillmor <>
In-Reply-To: <20150413181144.GA720@LK-Perkele-VII>
References: <> <20150412165542.GA19481@LK-Perkele-VII> <> <20150413181144.GA720@LK-Perkele-VII>
User-Agent: Notmuch/0.18.2 ( Emacs/24.4.1 (x86_64-pc-linux-gnu)
Date: Mon, 13 Apr 2015 16:59:53 -0400
Message-ID: <>
MIME-Version: 1.0
Content-Type: text/plain
Archived-At: <>
Subject: Re: [TLS] 0-RTT (Was: Re: 0-RTT and Anti-Replay)
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 13 Apr 2015 20:59:57 -0000

On Mon 2015-04-13 14:11:44 -0400, Ilari Liusvaara wrote:
> On Mon, Apr 13, 2015 at 10:02:43AM -0700, Martin Thomson wrote:
>> But I imagine that this depends on the model we employ.  Replayable
>> data could just be consider the start of a stream.  On the other hand,
>> unreliable data doesn't work very well for a stream mode.  Conversely,
>> replayable data makes no sense in a datagram mode, but all data is
>> unreliable there.
> I thought the recommended client-side interface called for auto-
> retransmit, which would mean that if application handled 0RTT as anything
> else than a prefix, it would now create two cases serverside.

Just because the data is replayable doesn't mean that it is replayable
*in the same stream*.

For TLS over TCP, both sides of the stream should be able to model the
state of the other side of the connection in a way that the next piece
of data sent depends on the understanding being correct.

If we decide that the client will auto-retransmit the payload, that
means that an attacker could cause *a second stream* to start in the
same way, not that the existing stream might or might not have the
initial payload loaded twice.