Subject: [TLS] 0RTT and HelloRetryRequest (Re: Narrowing the replay window)

From: Martin Thomson <[email-masked]>
Date: Thu, 31 Mar 2016 09:57:51 +1100

On 31 Mar 2016 5:56 AM, "Ilari Liusvaara" <[email-masked]> wrote:
> Then on topic of 0-RTT, how does 0-RTT key hashes behave if
> handshake is restarted (main handshake hash continues, but
> 0-RTT hash context currently needs to be separate from the
> main context)?

Good question. I don't recall that being discussed. I see three options :

1. Continue the hash, just like in 1-RTT

2. Treat HelloRetryRequest as a denial of the entire first flight.

3. Signal the choice.

Option 2 suits best if we consider HelloRetryRequest to be a DoS feature
exclusively or at least primarily. But we have other reasons for it and I
don't think that DoS mitigation is a big factor for TCP.

I think that option 1 is easy enough, since both sides have to extend the
hash in any case. 3 is just complexity.

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 30 Mar 2016 15:59:08 -0700

> don't think that DoS mitigation is a big factor for TCP.

I believe Option #2 is simplest.

-Ekr

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Martin Thomson <[email-masked]>
Date: Thu, 31 Mar 2016 12:18:45 +1100

> I believe Option #2 is simplest.

I didn't mention this because I was composing on a phone at the time,
but we have to decide whether to allow a second attempt at 0-RTT.  If
we do, then the effect is a two round trip setback.  I think that the
odds of this happening are small, so I'm OK with it, but I wanted to
highlight that.

---

From: Ilari Liusvaara <[email-masked]>
Date: Thu, 31 Mar 2016 08:09:28 +0300

> hash in any case. 3 is just complexity.

Yeah, I agree 3 is just complexity. Except I disagree that currently
option 1 is easy enough, since the hash going to creating 0-RTT keys
is not tapped from the main hash (if it was, then continuing would be
the simplest).

Relatedly, the proposal for "contexts" dropped the extra messages that
caused the difference between 0-RTT hash and 1-RTT hash.

-Ilari

---

From: Martin Thomson <[email-masked]>
Date: Thu, 31 Mar 2016 16:30:12 +1100

> is not tapped from the main hash (if it was, then continuing would be

Yeah, I should get this straight in my own mind as well.  I was
assuming that we were going to take something akin to Karthik's
"contexts" proposal and that would eliminate the differences in
hashes.

---

From: Ilari Liusvaara <[email-masked]>
Date: Thu, 31 Mar 2016 19:46:08 +0300

> odds of this happening are small, so I'm OK with it, but I wanted to

Not taking it could mix poorly with DTLS, as DTLS rejects need to be
stateless from server POV.

-Ilari