Replay Attacks

Cybersecurity 17 Sep 2026 6 min read

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure A returning TLS 1.3 client can possess a resumption ticket and application data ready to send before a new handshake has finished. Early data, commonly called 0-RTT data, permits those bytes to travel in the client’s first flight. The latency benefit changes a security property at exactly the point where an application may be tempted to act: early data does not carry the same replay protection as ordinary post-handshake application data.

Cybersecurity TLS 1.3

Cybersecurity 16 Sep 2026 8 min read

TLS 1.3 Early Data Moves Replay Risk Into HTTP Request Semantics

TLS 1.3 Early Data Moves Replay Risk Into HTTP Request Semantics A returning client can possess a TLS 1.3 resumption ticket and send an HTTP request before a new handshake has completed. That removes a round trip from the request path, but it also changes a security property that ordinary application code often assumes: accepted encrypted traffic is not necessarily unique to one connection. TLS 1.3 early data, commonly called 0-RTT data, is protected with keys derived from a pre-shared key associated with an earlier session or provisioned out of band. The request is encrypted, yet its protection does not depend on the fresh ServerHello from the new connection. As a result, TLS does not provide the same cross-connection replay protection for early data that it provides for application data sent after the handshake.

Cybersecurity TLS 1.3

Cybersecurity 15 Sep 2026 8 min read

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure A resumed TLS 1.3 connection can carry application bytes before the server has completed the new handshake. That latency reduction is attractive on paths where a round trip is expensive, but it changes a security property that applications often assume without naming it: a protected request is not necessarily fresh merely because the server decrypted it successfully. TLS 1.3 calls this facility early data, commonly described as 0-RTT. It is available when the client and server share a pre-shared key, including one established through a prior connection. The client can derive keys and send application data in its first flight rather than waiting for the server’s handshake messages.

Cybersecurity TLS 1.3

Cybersecurity 14 Sep 2026 8 min read

TLS Early Data Trades Latency for Replay Risk

A client reconnects to a service it visited recently and sends an HTTP request before the new TLS handshake has finished. The request can reach application processing sooner than traffic sent after handshake completion. That small latency gain is attractive at scale, but it changes a property applications often take for granted: a protected request is not automatically a fresh request. TLS 1.3 calls this feature early data, commonly described as 0-RTT data. It is available only in suitable resumed sessions, not on an initial connection with no prior session state. The client uses information associated with a previous connection to protect data sent immediately. The server can accept that data before the new handshake completes.

Cybersecurity TLS