Re: [TLS] 0-RTT and Anti-Replay

[Eric Rescorla <[e-mail]>]

Dave,

Thanks for raising this. In the interim I actually proposed ditching
Early Data and pushing ClientKeyShare into the ClientHello directly
and having the rest of the data go directly on the wire as TLS records,
so I think this is generally a good idea.

The idea here is that clients will never send unsolicited
Replayable/Idempotent
data to naive servers, and that servers which indicate support for 0-RTT
must be able to at least tolerate these messages and fall back to
1-RTT.

-Ekr




On Mon, Mar 23, 2015 at 12:59 PM, Dave Garrett <[e-mail]>
wrote:

> At this point in the discussion, it might be a good idea to fork the
> currently proposed Early Data extension. Instead of one general box, have
> two specialized boxes. The first would be an Early Handshake Data extension
> and would be explicitly limited to handshake messages. The second would be
> an Early Idempotent Application Data extension and would be explicitly
> limited to application data messages that must be safe and idempotent. The
> purpose of this is to reduce consideration of early data as a generic
> mechanism without specific considerations needed for proper usage. Servers
> that wish to refuse the latter could do so more easily.
>
>
> Dave
>