Re: [TLS] 0-RTT encrypted data limits

[Ilari Liusvaara <[e-mail]>]

On Wed, Aug 31, 2016 at 08:14:33PM +0200, Hubert Kario wrote:
> Current draft has the following text in it:
> 
>     If any of these checks fail, the server MUST NOT respond
>     with the extension and must discard all the remaining first
>     flight data (thus falling back to 1-RTT). If the client attempts
>     a 0-RTT handshake but the server rejects it, it will generally
>     not have the 0-RTT record protection keys and must instead
>     trial decrypt each record with the 1-RTT handshake keys
>     until it finds one that decrypts properly, and then pick up
>     the handshake from that point.
> 
> My understanding of that, in case client does 0-RTT but server rejects it 
> (because the PSK is too old or its time is different enough) is that the 
> server needs to keep on reading arbitrarily large amounts of data it has no 
> idea what to do with. All using slow path (thinking exception handling in 
> particular).

Yes, read the data and attempt to decrypt it with handshake keys (with
GCM and POLY1305, failed decryptions are faster than successful ones,
of course there is exception overhead if those are used).


-Ilari