Efficient Forward Security for TLS 1.3 0-RTT
summary
Presents a new session-resumption construction that plugs into TLS 1.3 0-RTT without client or protocol changes, trading negligible client work for server computation to recover past secrets. Uses a PPF-based ticket scheme (puncturable/evaluable function primitive) to give forward security for 0-RTT data and replay protection while avoiding large session caches. Claims unilateral server-only deployment, shows a hybrid ticket+cache design that stays practical in throughput tests and resists mass key-exposure.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:30Latency in Key Exchange
- 1:33Demand for Low Latency
- 3:56Approach to Reduce Latency
- 5:17TLS 1.3 Session Resumption (simplified)
- 6:39Forward Security
- 8:18Approach #1: Session Caches
- 10:18Approach #2: Session Tickets
- 17:19Puncturable Pseudorandom Functions (PPRF)
- 24:23Tree-based PPRF (Intuition)
- 30:44Tree-based PPRF - Worst Case
- 35:13Strong RSA-based PPRF (Intuition, simplified)
- 40:10Conclusion
related talks
52mWhat's New in TLS 1.3
45mUnlocking The Secrets Of TLS
53mHansel and Gretel do TLS
16mThe Challenges of 0-RTT in IETF QUIC
11mRTC @Scale, Resilience and Encryption Session | Live Q&A
19mWhat's happening in TLS (transport layer security)?
14mDetecting session hijacking using rotating refresh tokens in web applications
16mSeparate but Together: Integrating Remote Attestation into TLS