Re: [TLS] 0RTT?

[Eric Rescorla <[e-mail]>]

On Sun, Aug 3, 2014 at 7:43 PM, Watson Ladd <[e-mail]> wrote:

> On Sun, Aug 3, 2014 at 1:22 PM, Martin Thomson <[e-mail]>
> wrote:
> > This reads a like a halfway between the proposed 0RTT handshake and
> > resumption.  The advantage here I'm guessing being that this is
> > resumption, which means that you bind to a specific previous session.
> >
> > However, I keep hearing that the main benefit of resumption is that it
> > doesn't require a new DH operation.  And yes, this is still important
> > even with the higher performance EC provides.
>
> So I was going to make rekey optional. This wasn't very clear in my
> original email.
>
> >
> > This relies on an old session, whereas the proposed 0RTT uses a DH
> > share that is essentially public, so that it can be cached and shared
> > (DNS, signaling).
>
> That has costs with key rotation and administrative version. Maybe
> those aren't so bad. But I would like to see resumption be 0RTT also:
> right now it is 2RTT in TLS 1.2.


In TLS 1.2, I believe it's actually 1 RTT from the client's perspective:

      Client                                                Server

      ClientHello                   -------->
                                                       ServerHello
                                                [ChangeCipherSpec]
                                    <--------             Finished
      [ChangeCipherSpec]
      Finished                      -------->
      Application Data              <------->     Application Data

The client can send data on its second flight.

-Ekr