Subject: [TLS] Zero-RTT Data & PSK

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 9 Sep 2016 15:37:05 +0200

Hi all,

the current spec says:

---
2.3. Zero-RTT Data

When resuming via a PSK with an appropriate ticket (i.e., one with the 
“allow_early_data” flag), clients can also send data on their first 
flight (“early data”).
---

I am wondering why I cannot use Zero-RTT with just PSK-based 
authentication (without a prior ticket change).

Ciao
Hannes

---

From: Martin Thomson <[email-masked]>
Date: Sat, 10 Sep 2016 20:35:44 +1000

On 9 September 2016 at 23:37, Hannes Tschofenig
<[email-masked]> wrote:
> I am wondering why I cannot use Zero-RTT with just PSK-based authentication
> (without a prior ticket change).

I think that you would need to bind more things to the key in that
case, but I assume that it would be OK if you did so.  You already
need to pair a PSK with a hash, but if you paired it with a whole
cipher suite instead and also the ALPN (which could be null), then I
see no reason not to permit 0-RTT for pure PSK.  (I think that cipher
suite + ALPN is sufficient, but someone can correct me if I missed
anything.)