Re: [TLS] 0-RTT (Was: Re: 0-RTT and Anti-Replay)

[Daniel Kahn Gillmor <[e-mail]>]

On Mon 2015-04-13 14:11:44 -0400, Ilari Liusvaara wrote:
> On Mon, Apr 13, 2015 at 10:02:43AM -0700, Martin Thomson wrote:
>
>> But I imagine that this depends on the model we employ.  Replayable
>> data could just be consider the start of a stream.  On the other hand,
>> unreliable data doesn't work very well for a stream mode.  Conversely,
>> replayable data makes no sense in a datagram mode, but all data is
>> unreliable there.
>
> I thought the recommended client-side interface called for auto-
> retransmit, which would mean that if application handled 0RTT as anything
> else than a prefix, it would now create two cases serverside.

Just because the data is replayable doesn't mean that it is replayable
*in the same stream*.

For TLS over TCP, both sides of the stream should be able to model the
state of the other side of the connection in a way that the next piece
of data sent depends on the understanding being correct.

If we decide that the client will auto-retransmit the payload, that
means that an attacker could cause *a second stream* to start in the
same way, not that the existing stream might or might not have the
initial payload loaded twice.

        --dkg