Re: [TLS] 0-RTT and Anti-Replay

[Roland Zink <[e-mail]>]

On 23.03.2015 15:40, Viktor Dukhovni wrote:
> On Mon, Mar 23, 2015 at 03:33:09AM -0500, Nico Williams wrote:
>
>> Therefore, 0-RTT data must:
>>
>>      * Require a non-default code path to send, (explicit request
>>      by the client to send a 0-RTT message).
>>
>>      * Require a non-default code path to *receive*.  That is,
>>        the server must be configured to allow receipt of such data,
>>        and must explicitly request to read it.  If the server issues
>>        a read for protected data, while expedited 0-RTT data is
>>        pending, the connection should be aborted by the server's
>>        TLS stack.  Once the server exhausts all the expedited
>>        data, it can switch to reading protected data.
>>
>>      * The server's TLS stack must not coallesce 0-RTT expedited
>>        (idempotent) data with subsequent protected data.
Often there is a whole software stack on top of TLS. You probably can't 
forward the requirements through the complete software stack.
>>
>> This allows servers that receive idempotent queries to avoid the
>> 1-RTT latency.  Something akin to DNS lookups over TLS, (I am not
>> specifically advocating TLS as a transport for DNS in this message).
Even DNS queries may have side effects, for example when it is used to 
do load balancing.