Subject: Re: [TLS] 0-RTT and Anti-Replay

From: Dave Garrett <[email-masked]>
Date: Mon, 23 Mar 2015 13:59:19 -0400

At this point in the discussion, it might be a good idea to fork the currently proposed Early Data extension. Instead of one general box, have two specialized boxes. The first would be an Early Handshake Data extension and would be explicitly limited to handshake messages. The second would be an Early Idempotent Application Data extension and would be explicitly limited to application data messages that must be safe and idempotent. The purpose of this is to reduce consideration of early data as a generic mechanism without specific considerations needed for proper usage. Servers that wish to refuse the latter could do so more easily.

Dave

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 23 Mar 2015 13:16:07 -0500

Dave,

Thanks for raising this. In the interim I actually proposed ditching
Early Data and pushing ClientKeyShare into the ClientHello directly
and having the rest of the data go directly on the wire as TLS records,
so I think this is generally a good idea.

The idea here is that clients will never send unsolicited
Replayable/Idempotent
data to naive servers, and that servers which indicate support for 0-RTT
must be able to at least tolerate these messages and fall back to
1-RTT.

-Ekr

On Mon, Mar 23, 2015 at 12:59 PM, Dave Garrett <[email-masked]>
wrote:

> At this point in the discussion, it might be a good idea to fork the
> currently proposed Early Data extension. Instead of one general box, have
> two specialized boxes. The first would be an Early Handshake Data extension
> and would be explicitly limited to handshake messages. The second would be
> an Early Idempotent Application Data extension and would be explicitly
> limited to application data messages that must be safe and idempotent. The
> purpose of this is to reduce consideration of early data as a generic
> mechanism without specific considerations needed for proper usage. Servers
> that wish to refuse the latter could do so more easily.
>
>
> Dave
>