Subject: [TLS] Would there be security issues with a 0-RTT resume?

From: Bill Cox <[email-masked]>
Date: Sat, 5 Dec 2015 16:24:49 -0800

I am not sure why we have a 0-RTT connect, but only a 1-RTT resume.  If
anything, it seems like it would be easier to have a secure 0-RTT resume
than a 0-RTT connect, though the 0-RTT connect does use some information
from prior connections.

Is there a good reason for having only a 0-RTT connect, and not resume?

Thanks,
Bill

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 5 Dec 2015 16:46:59 -0800

> Is there a good reason for having only a 0-RTT connect, and not resume?

The intention *is* to have a 0-RTT resume, since PSK and 0-RTT should be
compatible. The spec may not be entirely clear on this point, though.

-Ekr

Thanks,
> Bill
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Bill Cox <[email-masked]>
Date: Sat, 5 Dec 2015 19:32:36 -0800

> compatible. The spec may not be entirely clear on this point, though.

Oh!  Well, that's huge in some ways.  I think the spec could use some more
clarity here :)

Bill