Subject: [quicwg/base-drafts] Is 0RTT allowed after HRR? (#1168)

From: Lars Eggert <[email-masked]>
Date: Tue, 06 Mar 2018 07:05:08 -0800

When a client attempts a 0RTT handshake and gets a Retry from the server, can that client retry with another 0RTT handshake attempt, or does it need to fall back to 1RTT?

(Hit this issue during interop. My client sends an initial CI+0RTT packet pair, receives a retry, and then resends a new CI+0RTT packet pair. Is this permitted?)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1168

---

From: Antoine Delignat-Lavaud <[email-masked]>
Date: Tue, 06 Mar 2018 07:06:09 -0800

Note that the TLS 1.3 spec forbids the client to send the `early_data` extension after a `HelloRetryRequest`
https://tools.ietf.org/html/draft-ietf-tls-tls13-24#section-4.1.2

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1168#issuecomment-370811109

---

From: Lars Eggert <[email-masked]>
Date: Tue, 06 Mar 2018 15:29:09 +0000 (UTC)

I think that means that 0RTT after retry is *not* allowed

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1168#issuecomment-370818862

---

From: Lars Eggert <[email-masked]>
Date: Tue, 06 Mar 2018 15:29:54 +0000 (UTC)

@ekr said on slack:

> 0-RTT after retry is forbidden in TLS 1.3
> It's not like it somehow couldn't be made to work, we just concluded it was too confusing

and later

> TLS 1.3 *does* allow you to do a HRR with no other requested changes. We put that in so it would work with DTLS 1.3.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1168#issuecomment-370818642

---

From: Mike Bishop <[email-masked]>
Date: Tue, 06 Mar 2018 10:13:36 -0800

Given that we're trying not to modify TLS rules when running in QUIC, I'd agree.  Do you think we need text reminding implementers of this?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1168#issuecomment-370875509

---

From: Lars Eggert <[email-masked]>
Date: Tue, 06 Mar 2018 10:38:44 -0800

I think that would be helpful. I will add that when I did the 0RTT stuff in quant, and Jörg did it for pandora, we both found that part of the spec to be pretty underspecified. Pretty much the only thing that explains the details is Figure 3 in -tls.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1168#issuecomment-370883528