[noise] Encrypting 0-RTT payloads

[Trevor Perrin]

On Fri, Dec 7, 2018 at 11:06 AM Matthew Hodgson <matthew at matrix.org> wrote:
>
> In other news; we're experimenting with noise for transport layer
> encryption for CoAP (low-bandwidth REST-style protocol over UDP).
> However, we're butting up against the problems mentioned in "11.4.
> Out-of-order transport messages" in the spec - specifically the risk of
> missing and out-of-order handshake messages.  Is there any standard way
> emerging of how to handle this at the application layer (i guess from
> the NoiseTransport or NLS work)?

You could look at WireGuard, or maybe also the recent nQUIC.  I know
other people have similar questions, maybe we should discuss this more
as a shared effort.  But the opinion has also been expressed (I think
from Jason) that different approaches will make sense in different
circumstances.

So I don't have a great off-the-cuff / off-the-shelf answer for you.

Trevor