Re: [TLS] Simple, secure 0-RTT for the masses

[Bill Cox <[e-mail]>]

Second attempt, since Colm already broke my first attempt:

It uses a traditional server-side session-cache in addition to the current
client-side session-cache in TLS 1.3, and also a server-side ticket
encryption key.  The protocol looks like this:

During the initial 1-RTT handshake:
- create an encrypted ticket containing only the session ID and a
"resumption count" set to 0
- send the ticket to the client

During a 0-RTT resumption handshake:
- Decrypt the tikcet and get the session ID from the ticket, check for a
cache hit, and drop to 1-RTT if not found
- compare the resumption counts in the session state and ticket, and fall
back to 1-RTT if they do not match
- increment the resumption count in the ticket and session state
- send the updated ticket to the client

There is little PFS here.  Some can be had by flushing stale cache entries
and rotating the ticket encryption key often.

Are there any holes in this scheme?

Bill