TLS 1.3 0-RTT: fast, and replayable

2024-03-23 · 2 min readNetwork

0-RTT lets a client send application data in the first round trip, saving a RTT. The cost: an attacker can capture and replay that data, and the server cannot tell a fresh request from a replayed one.

So it suits idempotent operations only — GETs and static assets. Anything that changes state (orders, payments, messages) must not use early data.

nginx leaves it off; enabling is explicit:

ssl_early_data on;

Pair it with a rejection of unsafe methods:

if ($request_method !~ ^(GET|HEAD)$) {
    return 425;
}

425 Too Early exists for exactly this. Most sites do not need 0-RTT; the saved round trip is not worth introducing replay.