Re: [Unbearable] 0-RTT Token Binding: When to switch exporters?

[Nick Harper <[e-mail]>]

On Tue, Feb 28, 2017 at 12:55 PM, Andrei Popov
<[e-mail]> wrote:
> Correct, the ClientHello is also needed. Not sure this makes things
> significantly better, but it is an additional piece the attacker needs. I
> guess we’re referring to the same attack, but disagreeing on whether “this
> still has decent security properties”J.

Yes, it sounds like we're talking about the same attack, and the
additional piece of the ClientHello (in addition to the resumption
PSK) doesn't change its feasibility that much. If we do any form of
0-RTT Token Binding, this attack will exist in some form. It is the
major difference between 0-RTT Token Binding and regular Token
Binding. My comment about "decent security properties" was that always
using the 0-RTT exporter (if there is a token binding sent and
accepted in early data) has decent security properties compared to
using the 0-RTT exporter only for token bindings sent in early data.
>
>
> It seems that the right thing to do is not allow Token Binding messages
> until exporter_secret is available.

That restriction would effectively mean that Token Binding can't be
used with 0-RTT.