Subject: [TLS] [Technical Errata Reported] RFC8446 (6145)

From: RFC Errata System <[email-masked]>
Date: Wed, 29 Apr 2020 02:47:23 -0700 (PDT)

The following errata report has been submitted for RFC8446,
"The Transport Layer Security (TLS) Protocol Version 1.3".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6145

--------------------------------------
Type: Technical
Reported by: Ben Smyth <[email-masked]>

Section: 4.2.10.

Original Text
-------------
When a PSK is used and early data is allowed for that PSK

Corrected Text
--------------

Notes
-----
I couldn't find restrictions that forbid early data for a PSK. Explaining where such restrictions
could exist would be useful. E.g., PSKs might be associated with data that forbids early data.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC8446 (draft-ietf-tls-tls13-28)
--------------------------------------
Title               : The Transport Layer Security (TLS) Protocol Version 1.3
Publication Date    : August 2018
Author(s)           : E. Rescorla
Category            : PROPOSED STANDARD
Source              : Transport Layer Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Ben Smyth <[email-masked]>
Date: Thu, 30 Apr 2020 10:01:21 +0200

> Original Text

That's an oversight on my part:

   The sole extension currently defined for NewSessionTicket is
   "early_data", indicating that the ticket may be used to send 0-RTT
   data

The client may only send early data when permitted:

   When a PSK is used and early data is allowed for that PSK, the client
   can send Application Data in its first flight of messages.

Servers don't appear to be forbidden from consuming early data when keys
don't permit them to. Perhaps I've missed that too. Or perhaps it doesn't
matter: If a client does something they aren't supposed to, then they're
only compromising their own security.