Re: [Unbearable] 0-RTT Token Binding: When to switch exporters?

[Andrei Popov <[e-mail]>]

Ø  The attacker needs more than just the TLS "Early Secret". The attacker needs the resumption PSK (effectively the Early Secret), but also the ClientHello used for a 0-RTT connection and the Sec-Token-Binding header sent on that 0-RTT connection.
Correct, the ClientHello is also needed. Not sure this makes things significantly better, but it is an additional piece the attacker needs. I guess we’re referring to the same attack, but disagreeing on whether “this still has decent security properties”☺.


Ø  TLS 1.3 doesn't provide any mechanism for a server to say "I don't like that that request was sent in early data, please send it again now that the handshake is complete", and I'm not aware of any application layer specs (e.g. HTTP) that have such a mechanism. That's how I reached the conclusion that the server won't reject some requests sent in early data.
HTTP allows the server to reject individual requests, therefore I disagree with the above logic. E.g. an HTTP server could reject a security-sensitive request authenticated by a replayable token, but accept other requests.

It seems that the right thing to do is not allow Token Binding messages until exporter_secret is available.

Cheers,

Andrei