Subject: Question about 0-RTT

From: William Herrin <[email-masked]>
Date: Wed, 3 Jul 2019 15:28:38 -0700

Hi folks,

Reading https://tools.ietf.org/html/draft-ietf-quic-transport-20, I have a
question about 0-RTT: What is it?

The draft talks a lot about it, but I didn't see anywhere that clearly
defined what it is. When I see "RTT" without a definition I tend to think
"round trip time," but the explanation of 0-RTT seems to have more to do
with encryption setup during connection initialization than any tie to
which round trip completes the setup. I find this confusing.

Would someone comment and either show me the definition I missed or add one
to the next draft?

Thanks,
Bill Herrin

-- 
William Herrin
[email-masked]
https://bill.herrin.us/

---

From: "Lubashev, Igor" <[email-masked]>
Date: Wed, 3 Jul 2019 23:21:28 +0000

Hi Bill,

0-RTT is a term commonly used by TLS – the crypto protocol that QUIC uses to secure data.
See https://tools.ietf.org/html/rfc8446#section-2.3.

0-RTT is a feature of a protocol that allows data to be delivered to the other endpoint in less than 1 RTT (round trip time) from the connection initiation (more accurately, it is a protocol feature that allows data to be sent before the protocol handshake is complete).

0-RTT data (also known as “early data”) is the data that is sent before the handshake completion.  0-RTT packets are packets containing 0-RTT data.

  *   Igor

From: William Herrin <[email-masked]>
Sent: Wednesday, July 03, 2019 6:29 PM
To: [email-masked]
Subject: Question about 0-RTT

Hi folks,

Reading https://tools.ietf.org/html/draft-ietf-quic-transport-20<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dquic-2Dtransport-2D20&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=msfZzbaeOpr7Gt4WhhK5mhZnk3Rzx2GqgBOkE18nG6c&s=Qp2ZTiT1jKK_6xTpaZAgSlJK9epps9hNNzWC7KxS7Js&e=>, I have a question about 0-RTT: What is it?

The draft talks a lot about it, but I didn't see anywhere that clearly defined what it is. When I see "RTT" without a definition I tend to think "round trip time," but the explanation of 0-RTT seems to have more to do with encryption setup during connection initialization than any tie to which round trip completes the setup. I find this confusing.

Would someone comment and either show me the definition I missed or add one to the next draft?

Thanks,
Bill Herrin

--
William Herrin
[email-masked]<mailto:[email-masked]>
https://bill.herrin.us/<https://urldefense.proofpoint.com/v2/url?u=https-3A__bill.herrin.us_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=msfZzbaeOpr7Gt4WhhK5mhZnk3Rzx2GqgBOkE18nG6c&s=jPAJj-S1TqI7CHKFAOfs473d_g6_fQPYYjttzpRopic&e=>

---

From: William Herrin <[email-masked]>
Date: Wed, 3 Jul 2019 16:52:09 -0700

Thanks Igor,

I get the impression in RFC8446 that 0-RTT data is literally transmitted in
the first round trip before the server returns back the key. After the
first round trip, the data is always encrypted. Is that accurate?

Is that true in QUIC as well? I was under the (possibly mistaken)
impression that quic will in some cases need additional round trips before
negotiation is complete and it moves to the 1-RTT state?

Regardless, can something be added to section 1.2 (terms and definitions)
referring the reader to the explanation of 0-RTT and 1-RTT?

Thanks,
Bill Herrin

On Wed, Jul 3, 2019 at 4:21 PM Lubashev, Igor <[email-masked]> wrote:

> 0-RTT is a feature of a protocol that allows data to be delivered to the
> other endpoint in less than 1 RTT (round trip time) from the connection
> initiation (more accurately, it is a protocol feature that allows data to
> be sent before the protocol handshake is complete).
>
>
>
> 0-RTT data (also known as “early data”) is the data that is sent before
> the handshake completion.  0-RTT packets are packets containing 0-RTT data.
>
>
>
>    - Igor
>
>
>
> *From:* William Herrin <[email-masked]>
> *Sent:* Wednesday, July 03, 2019 6:29 PM
> *To:* [email-masked]
> *Subject:* Question about 0-RTT
>
>
>
> Hi folks,
>
>
>
> Reading https://tools.ietf.org/html/draft-ietf-quic-transport-20
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dquic-2Dtransport-2D20&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=msfZzbaeOpr7Gt4WhhK5mhZnk3Rzx2GqgBOkE18nG6c&s=Qp2ZTiT1jKK_6xTpaZAgSlJK9epps9hNNzWC7KxS7Js&e=>,
> I have a question about 0-RTT: What is it?
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__bill.herrin.us_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=msfZzbaeOpr7Gt4WhhK5mhZnk3Rzx2GqgBOkE18nG6c&s=jPAJj-S1TqI7CHKFAOfs473d_g6_fQPYYjttzpRopic&e=>
>

-- 
William Herrin
[email-masked]
https://bill.herrin.us/

---

From: Patrick McManus <[email-masked]>
Date: Wed, 3 Jul 2019 20:58:04 -0400

On Wed, Jul 3, 2019 at 7:54 PM William Herrin <[email-masked]> wrote:

> Thanks Igor,
>
> I get the impression in RFC8446 that 0-RTT data is literally transmitted
> in the first round trip before the server returns back the key. After the

it is encrypted in both the first round trip and thereafter - the two
phases just use different keys. The 0-RTT key is distributed in an earlier
session (so this is only for repeat visitors). Its not ephemeral to the
session you're in, so it is replaced with the ephemeral 1-RTT key as soon
as possible.

---

From: "Lubashev, Igor" <[email-masked]>
Date: Thu, 4 Jul 2019 00:59:58 +0000

I recommend you also familiarize yourself with https://tools.ietf.org/html/draft-ietf-quic-tls-20#section-2.1.  It gives a good overview of TLS and later in the text describes how TLS is used in QUIC.  It is referenced from the Transport draft is a few key places.

Most often, yes, 0-RTT data will be transmitted only in the first round trip (except if a server’s handshake packet is lost). Note that 0-RTT data is also encrypted using keys received in a prior connection!

Of course, if 0-RTT packets are rejected by the server (see Version Negotiation and Retry packets), the client may need to resend 0-RTT data again.

  *   Igor

From: William Herrin <[email-masked]>
Sent: Wednesday, July 03, 2019 7:52 PM
To: Lubashev, Igor <[email-masked]>
Cc: [email-masked]
Subject: Re: Question about 0-RTT

Thanks Igor,

I get the impression in RFC8446 that 0-RTT data is literally transmitted in the first round trip before the server returns back the key. After the first round trip, the data is always encrypted. Is that accurate?

Is that true in QUIC as well? I was under the (possibly mistaken) impression that quic will in some cases need additional round trips before negotiation is complete and it moves to the 1-RTT state?

Regardless, can something be added to section 1.2 (terms and definitions) referring the reader to the explanation of 0-RTT and 1-RTT?

Thanks,
Bill Herrin

On Wed, Jul 3, 2019 at 4:21 PM Lubashev, Igor <[email-masked]<mailto:[email-masked]>> wrote:
Hi Bill,

0-RTT is a term commonly used by TLS – the crypto protocol that QUIC uses to secure data.
See https://tools.ietf.org/html/rfc8446#section-2.3<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc8446-23section-2D2.3&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=d0KcURGrcHxZbPgbOhMFQVWDioNjMfOuw0cA8k2AhKg&s=rCBQpRDg-vAwT4eJhwm4PkWpHp-JrviatUMszI3yzJE&e=>.

  *   Igor

From: William Herrin <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, July 03, 2019 6:29 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Question about 0-RTT

Hi folks,

Thanks,
Bill Herrin

--
William Herrin
[email-masked]<mailto:[email-masked]>
https://bill.herrin.us/<https://urldefense.proofpoint.com/v2/url?u=https-3A__bill.herrin.us_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=d0KcURGrcHxZbPgbOhMFQVWDioNjMfOuw0cA8k2AhKg&s=_bJSyRDpLBIuaAHlAOywblTprBzS1rItCEyJcXW-uhw&e=>