{"action":"created","comment":{"url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments/117149482","pull_request_review_id":38826399,"id":117149482,"diff_hunk":"@@ -3588,6 +3554,160 @@ appropriate application traffic key as described in {{updating-traffic-keys}}.\n In particular, this includes any alerts sent by the\n server in response to client Certificate and CertificateVerify messages.\n \n+## 0-RTT and Anti-Replay {#anti-replay}\n+\n+As noted in {{zero-rtt-data}}, unlike 1-RTT data, TLS does not provide\n+inherent replay protections for 0-RTT data. Instead, it provides\n+mechanisms which allow a server to implement a number of limited\n+server-side anti-replay defenses.\n+Servers need not permit 0-RTT at all, but those which do\n+SHOULD implement\n+either Single-Use Tickets {{single-use-tickets}} or\n+Client Hello Recording {{client-hello-recording}}\n+as described\n+below, and if not, SHOULD implement the stateless mechanism\n+described in {{stateless-anti-replay}}.\n+See {{replay-0rtt}} for more information on the limitations\n+of these mechanisms.\n+\n+Clients are unable to determine which, if any, of these mechanisms\n+servers actually implement and therefore MUST only send early\n+data which they are willing to have subject to the attacks\n+described in {{replay-0rtt}}.\n+\n+\n+### Single-Use Tickets\n+\n+The simplest form of anti-replay defense is for the server to only\n+allow each session ticket once. In order to implement this, the server\n+maintains a database of all outstanding valid tickets; deleting each\n+ticket from the database as it is used. If an unknown ticket is\n+provided, the server falls back to a full handshake as normal.\n+\n+If the tickets are not self-contained but rather are database keys,\n+and these PSKs are deleted upon use, then connections established\n+using one PSK enjoy forward security. This is a security advantage for\n+all 0-RTT data and for PSK usage when PSK is used without DH.\n+\n+Because this mechanism requires sharing the session database between\n+server nodes, in environments with multiple distributed servers\n+it may be hard to achieve high rates of PSK 0-RTT\n+success when compared with self-encrypted tickets which do not\n+require consistent server-side storage for PSK-based session\n+establishment but do require it for anti-replay if 0-RTT is allowed,\n+as described below.\n+\n+\n+### Client Hello Recording\n+\n+An alternative form of anti-replay is to record a unique value derived\n+from the ClientHello (generally either the random value or the PSK\n+binder) and reject duplicates. Recording all ClientHellos causes state\n+to grow without bound. A server can instead record ClientHellos within\n+a given time window and use the \"obfuscated_ticket_age\" to ensure that\n+tickets aren't reused outside that window.\n+\n+In order to implement this mechanism, a server needs to store the time\n+that the server generated the session ticket, offset by an estimate of\n+the round trip time between client and server. I.e.,\n+\n+~~~~\n+    adjusted_creation_time = creation time + estimated RTT\n+~~~~\n+\n+This value can be encoded in the ticket, thus avoiding the need to\n+keep state for each outstanding ticket. The server can determine the\n+client's view of the age of the ticket by subtracting the ticket's\n+\"ticket_age_add value\" from the \"obfuscated_ticket_age\" parameter in\n+the client's \"pre_shared_key\" extension. The server can determine the\n+\"expected arrival time\" of the ClientHello as:\n+\n+~~~~\n+    expected_arrival_time = adjusted_creation_time + client's ticket age\n+~~~~\n+\n+For a given storage window, the server implements anti-replay as\n+follows.\n+\n+1. Verify the PSK binder.","path":"draft-ietf-tls-tls13.md","position":217,"original_position":217,"commit_id":"771ed4845218a10ae8f68563a6700335d61f5bad","original_commit_id":"771ed4845218a10ae8f68563a6700335d61f5bad","user":{"login":"kaduk","id":1894506,"avatar_url":"https://avatars2.githubusercontent.com/u/1894506?v=3","gravatar_id":"","url":"https://api.github.com/users/kaduk","html_url":"https://github.com/kaduk","followers_url":"https://api.github.com/users/kaduk/followers","following_url":"https://api.github.com/users/kaduk/following{/other_user}","gists_url":"https://api.github.com/users/kaduk/gists{/gist_id}","starred_url":"https://api.github.com/users/kaduk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaduk/subscriptions","organizations_url":"https://api.github.com/users/kaduk/orgs","repos_url":"https://api.github.com/users/kaduk/repos","events_url":"https://api.github.com/users/kaduk/events{/privacy}","received_events_url":"https://api.github.com/users/kaduk/received_events","type":"User","site_admin":false},"body":"\"What do I do if the verification fails?\"","created_at":"2017-05-18T02:17:19Z","updated_at":"2017-05-18T02:37:32Z","html_url":"https://github.com/tlswg/tls13-spec/pull/1005#discussion_r117149482","pull_request_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005","_links":{"self":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments/117149482"},"html":{"href":"https://github.com/tlswg/tls13-spec/pull/1005#discussion_r117149482"},"pull_request":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005"}}},"pull_request":{"url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005","id":119067761,"html_url":"https://github.com/tlswg/tls13-spec/pull/1005","diff_url":"https://github.com/tlswg/tls13-spec/pull/1005.diff","patch_url":"https://github.com/tlswg/tls13-spec/pull/1005.patch","issue_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/1005","number":1005,"state":"open","locked":false,"title":"Anti replay","user":{"login":"ekr","id":1111457,"avatar_url":"https://avatars3.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"body":"","created_at":"2017-05-04T21:12:03Z","updated_at":"2017-05-18T02:37:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0dbb6848233959d8060210f7699d671faa5303ff","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005/commits","review_comments_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005/comments","review_comment_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments{/number}","comments_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/1005/comments","statuses_url":"https://api.github.com/repos/tlswg/tls13-spec/statuses/771ed4845218a10ae8f68563a6700335d61f5bad","head":{"label":"ekr:anti_replay","ref":"anti_replay","sha":"771ed4845218a10ae8f68563a6700335d61f5bad","user":{"login":"ekr","id":1111457,"avatar_url":"https://avatars3.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"repo":{"id":19185500,"name":"tls13-spec","full_name":"ekr/tls13-spec","owner":{"login":"ekr","id":1111457,"avatar_url":"https://avatars3.githubusercontent.com/u/1111457?v=3","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/ekr/tls13-spec","description":"TLS 1.3 Specification","fork":true,"url":"https://api.github.com/repos/ekr/tls13-spec","forks_url":"https://api.github.com/repos/ekr/tls13-spec/forks","keys_url":"https://api.github.com/repos/ekr/tls13-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ekr/tls13-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ekr/tls13-spec/teams","hooks_url":"https://api.github.com/repos/ekr/tls13-spec/hooks","issue_events_url":"https://api.github.com/repos/ekr/tls13-spec/issues/events{/number}","events_url":"https://api.github.com/repos/ekr/tls13-spec/events","assignees_url":"https://api.github.com/repos/ekr/tls13-spec/assignees{/user}","branches_url":"https://api.github.com/repos/ekr/tls13-spec/branches{/branch}","tags_url":"https://api.github.com/repos/ekr/tls13-spec/tags","blobs_url":"https://api.github.com/repos/ekr/tls13-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ekr/tls13-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ekr/tls13-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/ekr/tls13-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ekr/tls13-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/ekr/tls13-spec/languages","stargazers_url":"https://api.github.com/repos/ekr/tls13-spec/stargazers","contributors_url":"https://api.github.com/repos/ekr/tls13-spec/contributors","subscribers_url":"https://api.github.com/repos/ekr/tls13-spec/subscribers","subscription_url":"https://api.github.com/repos/ekr/tls13-spec/subscription","commits_url":"https://api.github.com/repos/ekr/tls13-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/ekr/tls13-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/ekr/tls13-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/ekr/tls13-spec/issues/comments{/number}","contents_url":"https://api.github.com/repos/ekr/tls13-spec/contents/{+path}","compare_url":"https://api.github.com/repos/ekr/tls13-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ekr/tls13-spec/merges","archive_url":"https://api.github.com/repos/ekr/tls13-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ekr/tls13-spec/downloads","issues_url":"https://api.github.com/repos/ekr/tls13-spec/issues{/number}","pulls_url":"https://api.github.com/repos/ekr/tls13-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/ekr/tls13-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/ekr/tls13-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ekr/tls13-spec/labels{/name}","releases_url":"https://api.github.com/repos/ekr/tls13-spec/releases{/id}","deployments_url":"https://api.github.com/repos/ekr/tls13-spec/deployments","created_at":"2014-04-26T18:47:51Z","updated_at":"2016-07-20T08:41:28Z","pushed_at":"2017-05-17T11:20:43Z","git_url":"git://github.com/ekr/tls13-spec.git","ssh_url":"git@github.com:ekr/tls13-spec.git","clone_url":"https://github.com/ekr/tls13-spec.git","svn_url":"https://github.com/ekr/tls13-spec","homepage":null,"size":4375,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":8,"forks":3,"open_issues":8,"watchers":0,"default_branch":"master"}},"base":{"label":"tlswg:master","ref":"master","sha":"8eade9e77dbe85d6bc3cf24b4e66f2329eb4c05e","user":{"login":"tlswg","id":6699659,"avatar_url":"https://avatars0.githubusercontent.com/u/6699659?v=3","gravatar_id":"","url":"https://api.github.com/users/tlswg","html_url":"https://github.com/tlswg","followers_url":"https://api.github.com/users/tlswg/followers","following_url":"https://api.github.com/users/tlswg/following{/other_user}","gists_url":"https://api.github.com/users/tlswg/gists{/gist_id}","starred_url":"https://api.github.com/users/tlswg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tlswg/subscriptions","organizations_url":"https://api.github.com/users/tlswg/orgs","repos_url":"https://api.github.com/users/tlswg/repos","events_url":"https://api.github.com/users/tlswg/events{/privacy}","received_events_url":"https://api.github.com/users/tlswg/received_events","type":"Organization","site_admin":false},"repo":{"id":18887842,"name":"tls13-spec","full_name":"tlswg/tls13-spec","owner":{"login":"tlswg","id":6699659,"avatar_url":"https://avatars0.githubusercontent.com/u/6699659?v=3","gravatar_id":"","url":"https://api.github.com/users/tlswg","html_url":"https://github.com/tlswg","followers_url":"https://api.github.com/users/tlswg/followers","following_url":"https://api.github.com/users/tlswg/following{/other_user}","gists_url":"https://api.github.com/users/tlswg/gists{/gist_id}","starred_url":"https://api.github.com/users/tlswg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tlswg/subscriptions","organizations_url":"https://api.github.com/users/tlswg/orgs","repos_url":"https://api.github.com/users/tlswg/repos","events_url":"https://api.github.com/users/tlswg/events{/privacy}","received_events_url":"https://api.github.com/users/tlswg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/tlswg/tls13-spec","description":"TLS 1.3 Specification","fork":false,"url":"https://api.github.com/repos/tlswg/tls13-spec","forks_url":"https://api.github.com/repos/tlswg/tls13-spec/forks","keys_url":"https://api.github.com/repos/tlswg/tls13-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/tlswg/tls13-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/tlswg/tls13-spec/teams","hooks_url":"https://api.github.com/repos/tlswg/tls13-spec/hooks","issue_events_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/events{/number}","events_url":"https://api.github.com/repos/tlswg/tls13-spec/events","assignees_url":"https://api.github.com/repos/tlswg/tls13-spec/assignees{/user}","branches_url":"https://api.github.com/repos/tlswg/tls13-spec/branches{/branch}","tags_url":"https://api.github.com/repos/tlswg/tls13-spec/tags","blobs_url":"https://api.github.com/repos/tlswg/tls13-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/tlswg/tls13-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/tlswg/tls13-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/tlswg/tls13-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/tlswg/tls13-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/tlswg/tls13-spec/languages","stargazers_url":"https://api.github.com/repos/tlswg/tls13-spec/stargazers","contributors_url":"https://api.github.com/repos/tlswg/tls13-spec/contributors","subscribers_url":"https://api.github.com/repos/tlswg/tls13-spec/subscribers","subscription_url":"https://api.github.com/repos/tlswg/tls13-spec/subscription","commits_url":"https://api.github.com/repos/tlswg/tls13-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/tlswg/tls13-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/tlswg/tls13-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/tlswg/tls13-spec/issues/comments{/number}","contents_url":"https://api.github.com/repos/tlswg/tls13-spec/contents/{+path}","compare_url":"https://api.github.com/repos/tlswg/tls13-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/tlswg/tls13-spec/merges","archive_url":"https://api.github.com/repos/tlswg/tls13-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/tlswg/tls13-spec/downloads","issues_url":"https://api.github.com/repos/tlswg/tls13-spec/issues{/number}","pulls_url":"https://api.github.com/repos/tlswg/tls13-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/tlswg/tls13-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/tlswg/tls13-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/tlswg/tls13-spec/labels{/name}","releases_url":"https://api.github.com/repos/tlswg/tls13-spec/releases{/id}","deployments_url":"https://api.github.com/repos/tlswg/tls13-spec/deployments","created_at":"2014-04-17T17:52:32Z","updated_at":"2017-05-16T17:14:50Z","pushed_at":"2017-05-17T11:25:02Z","git_url":"git://github.com/tlswg/tls13-spec.git","ssh_url":"git@github.com:tlswg/tls13-spec.git","clone_url":"https://github.com/tlswg/tls13-spec.git","svn_url":"https://github.com/tlswg/tls13-spec","homepage":null,"size":8723,"stargazers_count":336,"watchers_count":336,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":128,"mirror_url":null,"open_issues_count":10,"forks":128,"open_issues":10,"watchers":336,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005"},"html":{"href":"https://github.com/tlswg/tls13-spec/pull/1005"},"issue":{"href":"https://api.github.com/repos/tlswg/tls13-spec/issues/1005"},"comments":{"href":"https://api.github.com/repos/tlswg/tls13-spec/issues/1005/comments"},"review_comments":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005/comments"},"review_comment":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/tlswg/tls13-spec/pulls/1005/commits"},"statuses":{"href":"https://api.github.com/repos/tlswg/tls13-spec/statuses/771ed4845218a10ae8f68563a6700335d61f5bad"}}}}
{"actor":{"display_login":"kaduk"}}