Re: [TLS] 0-RTT and Anti-Replay

[Nico Williams <[e-mail]>]

On Sun, Mar 22, 2015 at 02:49:28PM -0700, Eric Rescorla wrote:
> A MORE REALISTIC ATTACK
> During the interim meeting, DKG observed that you could produce the
> same "I've forgotten my state" situation if you have a distributed
> server. Say that the server operates in two loosely-synchronized
> data centers. In that case, you can get the following situation
> (shown without the attacker's intervention because of ASCII art
> limitation
> 
>  Client             Attacker            Server1              Server 2
> 
> ClientHello [+0-RTT] -->
> "POST /buy-something" ->
> 
>                     ClientHello [+0-RTT] -->
>                     "POST /buy-something" ->
> 
>                                         [Processes
>                                          purchase]
> 
> 
> 
>                     ClientHello [+0-RTT] ----------------------->
>                     "POST /buy-something" ---------------------->
> 
> 
>    <--------------------------------------  ServerHello [reject 0-RTT]
>                                                  (+ rest of handshake)
> 
> Finished --------------------------------------------------------->
> "Post /buy-something" -------------------------------------------->
>                                                   [Processes purchase]

If the client's first message had a nonce that the reject message (or
subsequent handshake) could authenticate, then this attack goes away
because the client will see that its message has been played, therefore
the client should not play it again.  Now the client application needs a
way to recover other than repeating the request!  It needs to go check
the status of whatever it wanted done (a GET, here).

Nico
--