News for hackers. Stuff that matters.
Re:TLS 1.3 at Apple by readams on Wednesday June 14, 2017 @05:55PM (#14556419)
0-RTT is sort of inherently vulnerable to replay at the protocol level. By definition you can't do any negotiation, so you can't get rid of replay attacks. 0-RTT is a special feature useful for specific applications where the security implications have been carefully thought through.

In other words, expect a large wave of 0-RTT vulnerabilities in the future.

Re:TLS 1.3 at Apple by comex on Wednesday June 14, 2017 @09:14PM (#14557229)
Well, TLS 0-RTT is only for resumptions, not a client’s first connection to a server. And the writeup in the parent post suggests requiring the server to enforce atomic single-use resumption tickets, which would in fact get rid of replay attacks - at the cost of effectively prohibiting servers/CDNs from sharing tickets across multiple data centers, since then atomicity would require them to communicate (adding additional latency) before accepting each ticket.