1656429 - RTT estimate used for 0-RTT anti-replay is incorrect for SSL_SendSessionTicket

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Martin Thomson [:mt:]]

RTT estimation is used to correct for the propagation delay involved in transmitting a session ticket and later having it used for 0-RTT. This helps narrow the window we use for anti-replay.

The way it currently works is that a value is set when the ServerHello is sent, then that is used as a reference point when sending NewSessionTicket. This only works when NewSessionTicket is sent at the end of the handshake. If SSL_SendSessionTicket is sent later, the RTT estimate is massively inflated.

The fix is to finalize the calculation of the estimate during the handshake.

Comment 1

[Martin Thomson [:mt:]]

Attachment: Bug 1656429 - Correct RTT estimate used in anti-replay, r?kjacobs

This was never a security problem, but the more time that passes between the
handshake and sending a ticket, the more likely we are to reject 0-RTT.
Eventually, 0-RTT only works if it is delayed in the network by a surprising
amount.

Comment 2

[Kevin Jacobs [:kjacobs]]

https://hg.mozilla.org/projects/nss/rev/b4a1c57eb569859170ef7b321039404f537f8fb9