Receiving ACKs for 0-RTT

[ekr]

A client only receives acknowledgments for its 0-RTT packets once the handshake
is complete. Consequently, a server might expect 0-RTT packets to start with a

However, this is not necessarily strictly true, because you might have the ACKs in 0.5RTT. Now you might say that the TLS stack reports the handshake as complete as soon as it receives Finished but that's an implementation detail

[martinthomson]

I think that this is true. The server can send before then, but we require that the client not install 1-RTT keys until it considers the handshake complete.

[marten-seemann]

we require that the client not install 1-RTT keys until it considers the handshake complete.

That's not entirely true. It's the server that needs to hold back keys (namely, the 1-RTT read key) until the handshake completes. The client can use keys as soon as they become available.

[kazuho]

I think @martinthomson is correct in sense that the following three events happen at the same moment on the client side:

• handshake is declared complete
• TLS stack provides the 1-RTT read and write keys
• TLS stack provides ClientFinished

[huitema]

Martin is correct. There are two different forms of handshake completion: complete when 1rtt can be sent and received, confirmed when the peer is known to be complete. The client cannot receive 0rtt acks before installing 1rtt keys, hence before hanshake is complete.