4 ms·
Without a round trip, we must be reusing keys right? So no more ephemeral keys? I know it's optional, but I wonder which will be the default for most off the
by ndesaulniers 8y ago
Without a round trip, we must be reusing keys right? So no more ephemeral keys? I know it's optional, but I wonder which will be the default for most off the shelf https severs folks use?
- tialaramex 8y ago1. Yes 0RTT uses a key agreed during a previous TLS session 2. The intent is that correct servers will never do 0RTT unless there's some explicit buy-in from the application. Allowing 0RTT unconditionally is almost invariably going to end badly. A static web site (all idempotent GETs) ought to be OK, and making it safe for toy (single server, transactional) apps isn't so hard, but 0RTT safely for serious stuff is hard, most people just shouldn't.