中文

Glossary

0-RTT (TLS 1.3 early data)

Last verified

Definition

0-RTT is a TLS 1.3 and QUIC feature that lets a returning client send application data in its very first flight, using a key from a previous session.

0-RTT, called early data in the TLS 1.3 specification (RFC 8446, now RFC 9846), works only on resumed connections. During an earlier session the server issued a session ticket that establishes a PSK; on the next connection the client sends its ClientHello and, in the same flight, application data encrypted with a key derived from that PSK, without waiting for the server's reply. QUIC offers the same mechanism.

Why it matters

It removes a full round trip for repeat visitors, which is noticeable on high-latency mobile links. The cost is weaker guarantees for the early data. It is not protected against replay, so an attacker who captures it can send it to the server again, and it lacks forward secrecy with respect to the PSK. Servers should therefore accept 0-RTT only for requests that are safe to repeat, such as GET requests without side effects. RFC 8470 defines the Early-Data: 1 request header and the 425 (Too Early) status code so that a backend can refuse early data it cannot handle safely.

Example

nginx can accept early data and tell the backend about it:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_early_data on;
proxy_set_header Early-Data $ssl_early_data;

The application should then answer 425 to any state-changing request that arrives with Early-Data: 1, and the client retries it after the handshake completes.

Common misconceptions

  • 0-RTT speeds up the first visit. A first connection has no PSK, so it always needs a full handshake; only resumed connections can use 0-RTT.
  • 0-RTT data is as secure as normal TLS 1.3 data. Only the early data loses replay protection and forward secrecy; everything sent after the handshake completes has full TLS 1.3 protection.
  • Turning it on is a free performance win. Without application-level replay handling it can duplicate payments, orders or other state-changing requests.

See also