Subject: [TLS] 0-RTT encrypted data limits

From: Hubert Kario <[email-masked]>
Date: Wed, 31 Aug 2016 20:14:33 +0200

Current draft has the following text in it:

    If any of these checks fail, the server MUST NOT respond
    with the extension and must discard all the remaining first
    flight data (thus falling back to 1-RTT). If the client attempts
    a 0-RTT handshake but the server rejects it, it will generally
    not have the 0-RTT record protection keys and must instead
    trial decrypt each record with the 1-RTT handshake keys
    until it finds one that decrypts properly, and then pick up
    the handshake from that point.

My understanding of that, in case client does 0-RTT but server rejects it 
(because the PSK is too old or its time is different enough) is that the 
server needs to keep on reading arbitrarily large amounts of data it has no 
idea what to do with. All using slow path (thinking exception handling in 
particular).

Is my understanding correct?

Why is there no limit on the amount of data that can be encrypted using PSK 
keys (0-RTT)?
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 31 Aug 2016 11:23:11 -0700

> Is my understanding correct?

It's not clear to me that it's particularly slow. You get a MAC failure and
rejecting
the packet is slightly faster than processing it.

> keys (0-RTT)?

I don't think this would usefully improve things.

-Ekr

--
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 31 Aug 2016 21:25:58 +0300

> idea what to do with. All using slow path (thinking exception handling in 

Yes, read the data and attempt to decrypt it with handshake keys (with
GCM and POLY1305, failed decryptions are faster than successful ones,
of course there is exception overhead if those are used).

-Ilari