What are the security concerns with TLS 1.3’s 0-RTT mode?
有哪些安全隐患 TLS 1.3的0-RTT模式？
TLS 1.3 offers a feature called 0-RTT (zero round trip time) Resumption mode, in an effort to enhance performance. When a browser successfully completes a TLS handshake with a server for the first time, both the client and the server can store a pre-shared encryption key locally. This is known as the resumption master secret. If the browser establishes a connection with the server again at a later time, it can use this resumption key to send encrypted application data in its first message to the server, without having to perform the handshake a second time. However, 0-RTT resumption has a caveat; resumption data require no interaction from the server, which means that an attacker can capture encrypted 0-RTT data and re-send them to the server, or replay them. In the case the server is misconfigured, it can potentially accept replayed requests as valid; essentially, allowing the attackers to perform unsanctioned actions. The solution to this issue is ensuring that all 0-RTT requests are idempotent. Idempotent requests can be safely used as 0-RTT requests, since replaying them will have no effect. A quick rule of thumb would be to only use GET requests with 0-RTT resumption.
TLS 1.3 提供了一个名为 0-RTT（零往返时间）恢复模式，以提高性能。 当浏览器成功完成 TLS 第一次与服务器握手时，客户端和服务器都可以在本地存储预共享的加密密钥。 这被称为 恢复主密码. 如果浏览器稍后再​​次与服务器建立连接，则可以使用此恢复密钥将其第一条消息中的加密应用程序数据发送到服务器，而无需第二次执行握手。 但是，恢复0-RTT有一个警告。 恢复数据不需要服务器的任何交互，这意味着攻击者可以捕获加密的0-RTT数据并将其重新发送到服务器，或者 重播 他们。 在服务器配置错误的情况下，它可能会接受重播的请求为有效； 本质上，允许攻击者执行未经批准的操作。 该问题的解决方案是确保所有0-RTT请求 幂等. 幂等请求可以安全地用作0-RTT请求，因为重播它们不会起作用。 一个快速的经验法则是只使用恢复为0-RTT的GET请求。