Cyber Risks · Trail of Bits Blog

What Application Developers Need To Know About TLS Early Data (0RTT)

Summary: TLS 1.3's 0-RTT (early data) feature lets a client encrypt data under a pre-shared key from a prior handshake and send it with the ClientHello, cutting a full round trip but making the request replayable and not forward secure. Trail of Bits shows that upgrading TLS infrastructure to 1.3 with 0-RTT enabled can make an existing API vulnerable to arbitrary replay with no application code changes, and notes Go, httpd, Python, and Ruby had no 0-RTT support as of March 2019 while Cloudflare disallows 0-RTT for all but GET requests with no query string.

What's compelling: A routine TLS upgrade can expose non-idempotent endpoints to replay without a single line of application code changing, and Cloudflare's GET-only restriction still leaves GET-based buy and sell APIs exposed.

Read the original at Trail of Bits Blog ↗