Re: [TLS] Cleaning up 0-RTT Signaling (ciphersuites, replays, PSK context)

[Bill Cox <[e-mail]>]

Adding 1 byte EarlyDataType seems like a good idea.

As for the CipherSuite, assuming DH-0RTT goes away, would it be simpler to
require that the cipher suite negotiated from the original 1-RTT connection
be used?

For channel binding, the only mode that seems to work with 0-RTT is when we
issue new tickets on each 0-RTT connection to emulate a single session like
we have in TLS 1.2, and use a replay cache on the server.  The only valid
proof-of-possession the server can do with the client before processing
application requests is the one done on the 1-RTT connection, so this
single proof needs to secure the entire chain of 0-RTT connections.  The
master resumption secret becomes a bearer token and needs to be protected
accordingly.

The Export Key Material API also needs to be updated.  The simplest
implementation where keys are derived from the current ephemeral secrets
will cause the exported keys to be different whenever new keys are
negotiated.  This will probably cause bugs at the application layer.  We
may need to have an EKM API that depends only on the original PSK, and
another one for generating ephemeral EKM material.

Bill