On Tue, Jun 21, 2016 at 10:07:17AM -0700, Ryan Hamilton wrote: > On Mon, Jun 20, 2016 at 6:15 PM, Martin Thomson <martin.thom...@gmail.com> > wrote: > > > David Benjamin wrote our section on 0-RTT backward compatibility to be > > a little bit lenient about server deployment. On consideration, I > > think that a simpler set of rules are better: > > > > 1. If the server advertises support for 0-RTT, then it implies a > > commitment to support TLS 1.3 for the duration of that advertisement. > > 2. Therefore, if the client attempts 0-RTT, then it should reject a > > ServerHello with TLS 1.2 or older. > > > > How does this affect the situation where a server might attempt to deploy > TLS 1.3, discover a bug, and need to rollback? Does it just magically work?
AFAIU, if one has 0-RTT-capable dynamic PSKs out there, one can only roll back 0-RTT support, but has to wait for all the PSKs to expire beefore being able to roll back TLS 1.3. Of course, the period between deploying TLS 1.3 and deploying 0-RTT should test how things work without 0-RTT (but it does not test 0-RTT failing, which is _critical_ to work correctly). -Ilari _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
