Re: [TLS] 0RTT?

[[e-mail] (Martin Rex)]

Watson Ladd wrote:
> 
> I think I came up with a decent idea for handling 0RTT handshakes,
> namely making resumption 0RTT, and doing a side rekeying.


These idea(s) seem to based on a number of extremely optimistic
assumptions that have zero chance to get airborne in many usage
scenarios.

The "regular" TLS session resumption means that client announces
a TLS session ID in ClientHello and server looks up that session ID
in its own cache for a match.  If there is no match, a regular
TLS full handshake proceeds.

0RTT is a no-go for a huge number of existing apps which do not
perform any fancy reconnect fallbacks at the application level
(closing the previous connection, opening a new connection and
starting a new handshake from scratch while requesting different
handshake characteristics this time).  For the general case
a 1RTT resumption is required, which can successfully perform
a full handshake in case that resumption is not possible,
without having to go through a connection/handshake failure.


> 
> The big limitation is ticket keys are going to need rotation. This
> also doesn't address the desire to put extra data in DNS to give some
> degree of forward secrecy, but I don't think you can change DNS that
> quickly without some problems.

The visibility of data DNS is another bold assumption that doesn't
hold for a number of usage scenarios.  It is pretty normal for
company networks to run their own DNS universe internally, and
provide accessibility to servers on the internet only through
HTTP CONNECT proxies.  In general, only these HTTP proxies have
access to both DNS universes (internet and internal).

I remember when Java applets became popular for use with online
brokers ~17 years ago, and lots of these applets crashed and burned
behind HTTP CONNECT proxies.  The browser had no problem connecting,
but the applets choked on hostnames that didn't resolve.  The
workaround was to add the brokers web server hostname with an
arbitrary ipv4 address (1.2.3.4) to the local host file so that
the Java applet would get a(n obviously useless) response
from gethostbyname() and be happy.


-Martin