Small TCP flows make up the majority of web flows. For them, the TCP three-way handshake represents a significant delay overhead. The TCP Fast Open (TFO) protocol provides zero round-trip time (0-RTT) handshakes for subsequent TCP connections to the same host. In this paper, we present real-world privacy and performance limitations of TFO. We investigated its deployment on popular websites and browsers. We found that a client revisiting a web site for the first time fails to use an abbreviated TFO handshake about 40\% of the time due to web server load-balancing  . Our analysis further reveals significant privacy problems in the protocol design and implementation. Network-based attackers and online trackers can exploit these shortcomings to track the online activities of users. As a countermeasure, we introduce a novel protocol called TCP Fast Open Privacy (FOP). It overcomes the performance and privacy limitations of TLS over TFO by utilizing a custom TLS extension. TCP FOP prevents tracking by network attackers and impedes third-party tracking, while still allowing for 0-RTT handshakes as in TFO. As a proof-of-concept, we have implemented the proposed protocol  . Our measurements indicate that TCP FOP outperforms TLS over TFO when websites are served from multiple IP addresses.
Small TCP flows make up the majority of web flows. For them, the TCP three-way handshake induces significant delay overhead. The TCP Fast Open (TFO) protocol can significantly decrease this delay via zero round-trip time (0-RTT) handshakes for all TCP handshakes that follow a full initial handshake to the same host. However, this comes at the cost of privacy limitations and also has some performance limitations. In this paper, we investigate the TFP deployment on popular websites and browsers. We found that a client revisiting a web site for the first time fails to use an abbreviated TFO handshake in 40\% of all cases due to web server load-balancing using multiple IP addresses . Our analysis further reveals significant privacy problems of the protocol design and implementation. Network-based attackers and online trackers can exploit TFO to track the online activities of users. As a countermeasure, we introduce a novel protocol called TCP Fast Open Privacy (FOP). TCP FOP prevents tracking by network attackers and impedes third-party tracking, while still allowing 0-RTT handshakes as in TFO. As a proof-of-concept, we have implemented the proposed protocol for the Linux kernel and a TLS library . Our measurements indicate that TCP FOP outperforms TLS over TFO when websites are served from multiple IP addresses.
R
represents a
induces
R
provides
can significantly decrease this delay via
R
subsequent TCP connections
all TCP handshakes that follow a full initial handshake
R
In this paper, we present real-world privacy and performance limitations of TFO. We investigated its
However, this comes at the cost of privacy limitations and also has some performance limitations. In this paper, we investigate the TFP
R
about
in
R
the time
all cases
A
using multiple IP addresses
R
in
of
R
these shortcomings
TFO
D
It overcomes the performance and privacy limitations of TLS over TFO by utilizing a custom TLS extension.
D
for
A
for the Linux kernel and a TLS library