On Wednesday, November 23, 2016 7:20 PM, Colm MacCárthaigh wrote: > > Prior to TLS1.3, replay is not possible, so the risks are new, but the > end-to-end designers > may not realize to update their threat model and just what is required. I'd > like to spell > that out more than what's where at present.
Uh? Replay was always possible, at the application level. Someone might for example click twice on the same URL, opening two tabs, closing one at random. And that's without counting on deliberate mischief. -- Christian Huitema _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
