TCP Fast Open? Not so fast

I did not know that was a thing!

https://serverfault.com/questions/698251/how-does-the-dns-pr...

https://irl.xyz/stuff/pubs/PATHspiderEvolution2017.pdf

But RFC7413 which describes TFO (https://datatracker.ietf.org/doc/html/rfc7413) still has an experimental status. This thing is not expected to be widely supported or work as production-quality feature, yet:

> Status of This Memo

> This document is not an Internet Standards Track specification; it is published for examination, experimental implementation, and evaluation.

I would be curious if anyone knows if a scheme like Zcash was considered. No, not another shitcoin, it's from 1983 and uses RSA blind signatures:

> Blind signatures can also be used to provide unlinkability, which prevents the signer from linking the blinded message it signs to a later un-blinded version that it may be called upon to verify. In this case, the signer's response is first "un-blinded" prior to verification in such a way that the signature remains valid for the un-blinded message.

I guess the issue would be too large signature sizes are needed for RSA, and that the verification operation is asymmetrically slower than what a client has to do, leading to a denial of service attack? Maybe the server could have (configurably) a per-IP limit of, for example, 4 opens per 20 seconds (bursty) and a global limit of 10% of CPU time as measured over 10 seconds. Above those limits, clients just have to do a 3WHS as usual or re-use connections if the protocol allows (http does).

I'm probably overthinking this but without blind signatures, it seems like no browser would enable it for privacy reasons. Technically it's illegal to use this for tracking without a reason (such as user consent or fraud protection or so), but that won't stop everyone from doing it.