Re: [TLS] 0-RTT and Anti-Replay

[Roland Zink <[e-mail]>]

On 23.03.2015 16:28, Viktor Dukhovni wrote:
> On Mon, Mar 23, 2015 at 04:16:10PM +0100, Roland Zink wrote:
>
>>>>      * The server's TLS stack must not coalesce 0-RTT expedited
>>>>        (idempotent) data with subsequent protected data.
>> Often there is a whole software stack on top of TLS. You probably can't
>> forward the requirements through the complete software stack.
> That's good.  Such software stacks will not be 0-RTT aware, and
> must not see 0-RTT data.  Only stacks explicitly designed for 0-RTT
> will get to play.
Seem like very limited use, but still when somebody builds something on 
top of such a stack not knowing that something special needs to be done. 
Simplest may be a HTTP library thinking GET requests are idempotent, 
which they should, and is doing 0-RTT and the server does something on 
the GET request like fire some missiles.
>>>> This allows servers that receive idempotent queries to avoid the
>>>> 1-RTT latency.  Something akin to DNS lookups over TLS, (I am not
>>>> specifically advocating TLS as a transport for DNS in this message).
>> Even DNS queries may have side effects, for example when it is used to do
>> load balancing.
> DNS "load-balancers" are really latency optimizers, they don't
> actually know how much load they are directing at servers because
> there is a not a 1-to-1 mapping between DNS requests and service
> requests.  There should be no state changes based on the observed
> DNS queries, and if even there are, nothing tragic happens.  The
> intended application here would be confidentiality only.
>
Well DNS is only an example anyway. Assuming the server is returning A,B 
on even requests and B,A on odd requests and an attacker replays all 
requests then the server will always returning the same result to the 
real clients.