Re: [TLS] 0-RTT and Anti-Replay

[Viktor Dukhovni <[e-mail]>]

On Mon, Mar 23, 2015 at 05:08:14PM +0100, Roland Zink wrote:

> > >Often there is a whole software stack on top of TLS. You probably can't
> > >forward the requirements through the complete software stack.
> >
> >That's good.  Such software stacks will not be 0-RTT aware, and
> >must not see 0-RTT data.  Only stacks explicitly designed for 0-RTT
> >will get to play.
>
> Seems like very limited use,

Deliberately so, for people who know what they are doing, to support
latency sensitive idempotent requests that don't need request replay
protection.

> but still when somebody builds something on top of such a stack not knowing
> that something special needs to be done.

They lose.

    * If clients make 0-RTT requests to a stack that does not
    support these, all connection abort when the stack requests
    non-expedited data, while expedited data is pending.

    * If the stack requests expedited data without an explicit
    request from the server application to do that, it is broken.
    Vulnerability reports will be filed, everyone will run around
    patching, ...

> Simplest may be a HTTP library thinking GET requests are idempotent, which
> they should, and is doing 0-RTT and the server does something on the GET
> request like fire some missiles.

HTTP libraries have no business doing that (bring on the sky is
falling vulnerability reports, emergency patch cycles, ...).  The
application would have to explicitly signal support for such
requests, and when they arrive they'd have to be clearly tagged as
such consistent with the API that enabled their delivery.

-- 
	Viktor.