From [1]: > 0-RTT data can be replayed If you want to allow 0-RTT, you need a way to specify which [api] calls are safe to run in 0-RTT, and which aren't. Whic

From [1]: > 0-RTT data can be replayed If you want to allow 0-RTT, you need a way to specify which [api] calls are safe to run in 0-RTT, and which aren't. Which in turn requires a sort of scheduler for calls, making your network stack pretty complex. In the post, for example, Facebook controls both the client and the server, so they can do that, but it's a non trivial problem for a general purpose library/implementation. [1] https://code.facebook.com/posts/608854979307125/building-zero-protocol-for-fast-secure-mobile-connections/ https://code.facebook.com/posts/608854979307125/building-zer... (Section Time-bound 0-RTT data)