Subject: Re: [quicwg/base-drafts] Idempotent is not the standard for 0-RTT (#4394)

From: Jana Iyengar <[email-masked]>
Date: Tue, 01 Dec 2020 15:17:06 -0800

@janaiyengar commented on this pull request.

> +MUST only use 0-RTT for application data that is permitted by the application
+that is in use.

```suggestion
MUST NOT use 0-RTT for application data unless specifically
requested by the application that is in use.
```

Aligning text with E.5 of RFC 8446. See https://github.com/quicwg/base-drafts/issues/4393#issuecomment-733634021

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4394#pullrequestreview-542377095

---

From: Martin Thomson <[email-masked]>
Date: Mon, 07 Dec 2020 02:01:21 -0800

@martinthomson pushed 1 commit.

d1870b8d6699e9253bff9f395db496d2ab8eef71  don't use unless requested

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4394/files/98239d66b2b8c4c6196582c2cad911be227490fb..d1870b8d6699e9253bff9f395db496d2ab8eef71

---

From: Martin Thomson <[email-masked]>
Date: Mon, 07 Dec 2020 02:03:27 -0800

@martinthomson commented on this pull request.

> @@ -1276,10 +1276,31 @@ If 0-RTT keys are available (see {{enable-0rtt}}), the lack of replay protection
 means that restrictions on their use are necessary to avoid replay attacks on
 the protocol.
 
-A client MUST only use 0-RTT keys to protect data that is idempotent.  A client
-MAY wish to apply additional restrictions on what data it sends prior to the
-completion of the TLS handshake.  A client otherwise treats 0-RTT keys as
-equivalent to 1-RTT keys, except that it MUST NOT send ACKs with 0-RTT keys.
+Of the frames defined in {{QUIC-TRANSPORT}}, the STREAM, RESET_STREAM, and
+CONNECTION_CLOSE frames are potentially unsafe for use with 0-RTT as they

How about you have to pay a fine for every PROTOCOL_VIOLATION that clients report?

All of this is completely contrived, but as David says, better that you know.  I don't think that it needs a ton of explanation though.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4394#discussion_r537377228

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Dec 2020 20:49:57 -0800

Merged #4394 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4394#event-4093158827