English
Menu

Applied Cryptography

Which of the following is a correct caution about 0-RTT in TLS 1.3 (sending "early data" together with the first message, using a pre-shared key obtained in an earlier connection)?

  1. AEarly data are sent unencrypted in plaintext, so they must not contain passwords, credit card numbers and the like
  2. BReplay attacks that resend recorded early data cannot be fully prevented, so it is used only for requests that are harmless if repeated
  3. CEarly data have stronger forward secrecy than normal data, so they should be used especially for important requests such as money transfers
Show answer and explanation

Answer: B. Replay attacks that resend recorded early data cannot be fully prevented, so it is used only for requests that are harmless if repeated

With 0-RTT, the client derives a key for early data from the pre-shared key received in an earlier connection and sends encrypted data together with its first message, saving one round trip of waiting. However, the server's new random value has not yet been used at this point, so if an attacker sends recorded early data again, the server may process the same request again (a replay attack). Also, early data are protected only by the pre-shared key, so there is no forward secrecy if that key leaks. Therefore 0-RTT is in principle limited to requests whose result does not change however many times they are executed, such as fetching a page, and is not used for money transfers or orders.

  • A. Early data are also encrypted with a key derived from the pre-shared key. The problem is not encryption but being resent.
  • B. Correct. Because protection against replay is insufficient, the requests it may be used for are restricted.
  • C. Early data are protected only by the pre-shared key and have weaker forward secrecy than normal data.
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. Which of the following correctly describes mutual TLS (mTLS)?
  2. Searching for the key of an n-bit symmetric-key cipher with Grover's algorithm on a quantum computer is said to take about 2^(n/2) computations. Using this simple guideline, which of the following is closest to the security of AES-128 against quantum computers?
  3. Which of the following correctly pairs the post-quantum cryptography standards published by the US NIST in August 2024 with their types?
  4. Which of the following correctly describes how a key encapsulation mechanism (KEM) such as ML-KEM is used?
  5. Which of the following correctly describes the idea of hybrid key exchange, used during the migration to post-quantum cryptography, that combines X25519 (Diffie–Hellman key exchange using an elliptic curve) with ML-KEM?

Comparisons in this topic