Early data can be replayed
050-RTT saves a round trip for selected data, but brings different security guarantees.
This guide explains the 2018 publication. Superseded by RFC 9846.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8 ↗
RFC 8446 · § 8EXAMPLE
4 / 4
04
Reject repeated early handshakes.
The application must also choose safe operations; a replay cache is not a universal guarantee.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Encryption does not make early data replay-proof.
- Clients must send only early data that they judge safe to replay.
- Each server instance must accept the same 0-RTT handshake at most once.
- Servers should provide stronger replay limits where feasible; TLS alone cannot prevent every duplicate application effect.
The examples simplify the wire representation. Follow the linked specification and application profile for implementation.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy