Replay Attacks on Zero Round-Trip Time: The Case of the TLS 1.3 Handshake Candidates
Automated Analysis and Verification of TLS 1.3: 0-RTT, Resumption and Delayed Authentication