Re:TLS 1.3 at Apple
by ecesena on Wednesday June 14, 2017 @05:36PM
(#14556301)
From [1]:
> 0-RTT data can be replayed
If you want to allow 0-RTT, you need a way to specify which [api] calls are safe to run in 0-RTT, and which aren't. Which in turn requires a sort of scheduler for calls, making your network stack pretty complex.
In the post, for example, Facebook controls both the client and the server, so they can do that, but it's a non trivial problem for a general purpose library/implementation.
Re:TLS 1.3 at Apple
by readams on Wednesday June 14, 2017 @05:50PM
(#14556390)
Even Facebook still requires the developers to manually declare things safe/unsafe for 0-RTT, and frankly the requirements for doing this securely are very subtle. This is a massive footgun.
If you want to allow 0-RTT, you need a way to specify which [api] calls are safe to run in 0-RTT, and which aren't. Which in turn requires a sort of scheduler for calls, making your network stack pretty complex.
In the post, for example, Facebook controls both the client and the server, so they can do that, but it's a non trivial problem for a general purpose library/implementation.
[1] https://code.facebook.com/posts/608854979307125/building-zer... (Section Time-bound 0-RTT data)