Re: [TLS] 0-RTT and Anti-Replay

[Nico Williams <[e-mail]>]

On Sun, Mar 22, 2015 at 08:35:34PM -0700, Martin Thomson wrote:
> For HTTP, I think we can use that first flight for idempotent queries
> quite easily and (at worst) the HTTP/2 connection preface.

But TLS can't know what's happening at the application layer, so it had
better be the case that the 0-RTT data is clearly denoted to the app as
"had better be idempotent".  I.e., this becomes an API issue.  The name
of the method would have to be indicative of danger.

0-RTT data is acted on at great risk.  It's OK to use it for negotiation
purposes where the integrity of the negotiation will eventually be
confirmed (else the connection fails).  For things like "launch
missiles" it is a very bad idea to act on the command before
authenticating it and determining that it's not a replay.  When we don't
know the nature of the data, we must assume it can't be sent without
authentication and replay protection.

Nico
--