miTLS API may confuse developers to write software which may be vulnerable to replay attacks

[oweisse-msft]

In miTLS, when resuming a session with a session ticket, the client simply call FFI_mitls_send, and the data may be sent over 0RTT. The server, calling FFI_mitls_receive will receive the data, without having any indication that the data is "early data" and is NOT replay protected. This can confuse developers and eventually cause software using miTLS to be vulnerable to replay attacks.

In comparison, OpenSSL have a complete separation of 0RTT data than the normal stream. They have

• SSL_read_early_data
• SSL_write_early_data

which allows the application to know which data is replay protected and which is not.

[BarryBo]

Let's think more about this as we tidy up the TLS interface.