Modern cryptographic protocols, such as TLS 1.3 and QUIC, can send cryptographically
protected data in “zero round-trip times (0-RTT)”, that is, without the need for a prior
interactive handshake. Such protocols meet the demand for communication with minimal
latency, but those currently deployed in practice achieve only rather weak security
properties, as they may not achieve forward security for the first transmitted payload
message and require additional countermeasures against replay attacks. Recently, 0-RTT …

Modern cryptographic protocols, such as TLS 1.3 and QUIC, can send cryptographically
protected data in “zero round-trip times (0-RTT)”, that is, without the need for a prior
interactive handshake. Such protocols meet the demand for communication with minimal
latency, but those currently deployed in practice achieve only rather weak security
properties, as they may not achieve forward security for the first transmitted payload
message and require additional countermeasures against replay attacks. Recently, 0-RTT …