Re: [TLS] Would there be security issues with a 0-RTT resume?

Eric Rescorla <ekr@rtfm.com> Sun, 06 December 2015 00:47 UTC

MIME-Version: 1.0
In-Reply-To: <CAH9QtQHtiuKnYoYoDpiNVz31HZH23sv9Bt-Rya985tWHorhcYA@mail.gmail.com>
References: <CAH9QtQHtiuKnYoYoDpiNVz31HZH23sv9Bt-Rya985tWHorhcYA@mail.gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Sat, 05 Dec 2015 16:46:59 -0800
Message-ID: <CABcZeBOujQ2Q5NoCOuQ3skyqDDs72-=P07k1WTZSDgMJWti+gQ@mail.gmail.com>
To: Bill Cox <waywardgeek@google.com>
Content-Type: multipart/alternative; boundary="001a114dc814618e37052630161d"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/nGTyXXgPOSJeI-O8t0mCf2ua8oE>
Cc: "tls@ietf.org" <TLS@ietf.org>
Subject: Re: [TLS] Would there be security issues with a 0-RTT resume?
Precedence: list

On Sat, Dec 5, 2015 at 4:24 PM, Bill Cox <waywardgeek@google.com> wrote:

> I am not sure why we have a 0-RTT connect, but only a 1-RTT resume.  If
> anything, it seems like it would be easier to have a secure 0-RTT resume
> than a 0-RTT connect, though the 0-RTT connect does use some information
> from prior connections.
>
> Is there a good reason for having only a 0-RTT connect, and not resume?
>

The intention *is* to have a 0-RTT resume, since PSK and 0-RTT should be
compatible. The spec may not be entirely clear on this point, though.

-Ekr

Thanks,
> Bill
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>

[TLS] Would there be security issues with a 0-RTT… Bill Cox
Re: [TLS] Would there be security issues with a 0… Eric Rescorla
Re: [TLS] Would there be security issues with a 0… Bill Cox