1

The general consensus appears to be that TLS 1.3 in 0-RTT mode over TCP in Fast-Open mode (TFO) is secure in terms of CIA as long as you trust the CA system and treat the early data as being potentially part of a reply attack. In particular there are concerns regarding replayability for both TFO and TLS 1.3 0-RTT.

In practice for HTTPS, this means that you should only allow GET requests in 0-RTT mode and have to ensure that all GET requests are indeed idempotent as is technically required by the HTTP spec. Correct so far?

Based on this my question is: Do these same concerns regarding replayablity also apply when enabling TFO on host supporting TLS 1.0-1.3 without also enabling the TLS 1.3 0-RTT feature?

My gut feeling on this is that the TLS handshake should fail in case of a replayed TFO packet and hence there should be no difference in terms of security between TLS over TCP with TFO and TLS over TCP without TFO, but I’m a crytographic layman and couldn’t find any solid research on this, so I thought I’d better ask before just enabling this mode on the company web servers… (In particular as of today, not all HTTPS GET endpoints are idempotent, so enabling TLS 1.3 0-RTT definitely isn’t an option in any case yet.)

Note: This should also be tagged tfo IMHO, but I’m not allowed to do that……

Improve this question
4
  • I've fixed your title. It asked about the security of TFO in the context of TLS 0-RTT while your question body asked about the security of TLS 0-RTT in the context of TFO.
    – Steffen Ullrich
    Commented Jan 26, 2022 at 18:26
  • @SteffenUllrich: That is incorrect and I already know that TLS 1.3 0-RTT security does not depend on the presence (or lack of presence) of TFO. I want to know if there is any potential impact of enabling TFO without TLS 1.3 0-RTT on HTTPS application security.
    – ntninja
    Commented Jan 26, 2022 at 18:37
  • @SteffenUllrich: Somehow you managed to answer my original question anyways, though… :grinning:
    – ntninja
    Commented Jan 26, 2022 at 18:39
  • 1
    I see, your last change to the title now reflects this better than your original title.
    – Steffen Ullrich
    Commented Jan 26, 2022 at 18:50

1 Answer 1

Reset to default
1

The security of TLS does not depend on the security of the underlying transport layer, i.e. TLS. All what it expects is a reliable transport layer, i.e. data transmitted in order, without loss and without duplication. And if this reliability is not provided TLS will just fail, i.e. it does not get insecure.

This also means that transport layer feature like TCP fast open does not impact the security of TLS.

Improve this answer
2
  • So just to be clear for this specific case: It is always safe to enable TFO for HTTPS without any impact on the basic security guarantees (CIA) of the TLS application payload data. That statement is correct as written?
    – ntninja
    Commented Jan 26, 2022 at 18:43
  • 1
    @ntninja: As I said - the security of TLS does not depend on the security of the underlying transport. This also means that the security of the application payload is never impacted by enabling TFO.
    – Steffen Ullrich
    Commented Jan 26, 2022 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .