View source for TCP Fast Open

{{Short description|Experimental TCP mechanism}}
In computer networking, '''TCP Fast Open''' ('''TFO''') is an extension to speed up the opening of successive [[Transmission Control Protocol]] (TCP) connections between two endpoints.  It works by using a ''TFO cookie'' (a TCP option), which is a cryptographic cookie stored on the client and set upon the initial connection with the server.<ref name="lwn">{{cite news |first=Michael |last=Kerrisk |date=2012-08-01 |title=TCP Fast Open: expediting web services |publisher=LWN.net |url=https://lwn.net/Articles/508865/ }}</ref> When the client later reconnects, it sends the initial SYN packet along with the TFO cookie data to authenticate itself. If successful, the server may start sending data to the client even before the reception of the final ACK packet of the three-way handshake, thus skipping a round-trip delay and lowering the [[Engineering:Latency (engineering)|latency]] in the start of data transmission.

The cookie is generated by applying a [[Block cipher|block cipher]] keyed on a key held secret by the server to the client's, generating an authentication tag that is difficult for third parties to spoof, even if they can forge a source IP address or make two-way connections to the same server from other IP addresses. Although it uses cryptographic techniques to generate the cookie, TFO is not intended to provide more security than the three-way handshake it replaces, and does not give any form of cryptographic protection to the resulting TCP connection, or provide identity assurance about either endpoint. It also is not intended to be resistant to [[Man-in-the-middle attack|man-in-the-middle attack]]s. If such resistance is required, it may be used in combination with a cryptographic protocol such as [[Transport Layer Security|TLS]] or [[IPsec]].

TFO has been difficult to deploy due to protocol ossification; in 2020, no [[Software:Web browser|Web browser]]s used it by default.{{sfn|Rybczyńska|2020}}

TFO presents [[Internet privacy|privacy]] challenges; the TFO cookie can allow persistently tracking a client across sessions, even by passive observers.{{sfn|Sy|Mueller|Burkert|Federrath|2020|p=275-279}}

== History ==
The TFO proposal was originally presented in 2011<ref>{{cite news
| title=TCP Fast Open
|vauthors=Radhakrishnan S, Cheng Y, Chu J, Jain A, Raghavan B | date=2011-12-06
| url=http://conferences.sigcomm.org/co-next/2011/papers/1569470463.pdf
| publisher=ACM CoNEXT }}</ref>
and was published as the experimental RFC 7413 in December 2014.<ref name=":0">{{cite ietf
| rfc=7413
| title=TCP Fast Open 
| publisher=[[Organization:Internet Engineering Task Force|IETF]]
| date=December 2014
| accessdate=27 June 2022 
| first1=Yuchung |last1=Cheng
| first2=Jerry |last2=Chu
| first3=Sivasankar |last3=Radhakrishnan
| first4=Arvind |last4=Jain  |name-list-style=amp }}</ref>  TCP Fast Open shares the goal of bypassing the three-way handshake of TCP with an earlier proposal from 1994, called T/TCP (RFC 1644). In contrast to TCP Fast Open, T/TCP paid no attention to security,<ref name=":0" /> opening a path for vulnerabilities and failing to gain traction.

== Characteristics ==
TFO implementations include the following:
* [[IPv4]] support for TFO was merged into the Linux kernel mainline in kernel versions 3.6 (support for clients) and 3.7 (Dec 2012) (support for servers),<ref name="kerrisk-lwn-01-09-2012">{{cite news |first=Michael |last=Kerrisk |url=https://lwn.net/Articles/508865/ |title=TCP Fast Open: expediting web services |publisher=LWN.net |date=2012-08-01 |quote=The client-side support has been merged for Linux 3.6}}</ref><ref>{{cite news |first=Steven J |last=Vaughan-Nichols |url=http://www.zdnet.com/linux-3-7-arrives-arm-developers-rejoice-7000008638/ |title=Linux 3.7 arrives, ARM developers rejoice |publisher=ZDNet |work=Linux and Open Source |date=2012-12-11 |quote=Linux 3.7. TCP Fast Open will now be supported on servers}}</ref> and was turned on by default in kernel version 3.13 (Jan 2014).<ref>{{cite web
 | title = Linux Kernel 3.13, Section 1.10. TCP Fast Open enabled by default
 | url = http://kernelnewbies.org/Linux_3.13#head-159ff61ea3acfd67b88855e75dbbb140f8825c4a
 | date = 19 January 2014 | accessdate = 11 February 2014
 | website = kernelnewbies.org
}}</ref>  TFO support for [[IPv6]] servers was merged in kernel version 3.16.<ref>{{cite web
 | title = Linux Kernel 3.16, Section 1.4. TCP Fast Open server mode on IPv6 support
 | url = http://kernelnewbies.org/Linux_3.16#head-93fbb9abc6149e9c3055322f27cdc3a8fcc198e6
 | date = 3 August 2014 | accessdate = 14 September 2014
 | website = kernelnewbies.org
}}</ref>
* [[Software:FreeBSD|FreeBSD]] from version 10.3<ref>{{cite web|url=https://svnweb.freebsd.org/base?view=revision&revision=292823|title=Implementation of server-side TCP Fast Open (TFO) [RFC7413]: MFC into stable/10 branch|date=2015-12-28}}</ref> (support for servers) and 12.0.<ref>{{cite web|url=https://svnweb.freebsd.org/base?view=revision&revision=330001|title=This is an implementation of the client side of TCP Fast Open (TFO) [RFC7413]|date=2018-02-26}}</ref><ref>{{Cite web|url=https://svnweb.freebsd.org/base?view=revision&revision=335610|title=Enable TCP_FASTOPEN by default for FreeBSD 12|date=2018-06-24}}</ref> (support for clients).
* [[Software:Mozilla Firefox|Mozilla Firefox]] from version 58.<ref>{{cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=1188435|title=1188435 - Support TCP Fast Open|date=2017-05-05}}</ref> The support was disabled by default due to network device compatibility issues with TFO and [[Transport Layer Security#TLS 1.3|TLS 1.3]]<ref>{{cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=1398201|title=1398201 - Disable TCP Fast Open for 57|date=2017-09-10}}</ref> and eventually removed in version 87.<ref>{{cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=1689604|title=1689604 - Remove TCP FastOpen|date=2021-03-23}}</ref>
* [[Software:Google Chrome|Google Chrome]] and [[Software:Chromium (web browser)|Chromium]] browsers have support for TFO on [[Software:Linux|Linux]], including [[Software:ChromeOS|ChromeOS]] and [[Software:Android (operating system)|Android]].
* [[Software:Exim|Exim]] mail transfer agent (MTA) from version 4.88.<ref>{{cite web|url=https://lists.exim.org/lurker/message/20161225.101705.4bbe7ae8.en.html|title=Exim 4.88 released|date=2016-12-25}}</ref>
* [[Software:Unbound (DNS server)|Unbound DNS Resolver]] from version 1.5.10.<ref>{{Cite web|url=https://www.unbound.net/pipermail/unbound-users/2016-September/004466.html|title=Unbound 1.5.10|access-date=2017-12-05}}</ref>
* [[Software:BIND|BIND]] [[Domain Name System]] (DNS) from version 9.11.0.<ref>{{cite web|url=https://ftp.isc.org/isc/bind9/9.11.0/RELEASE-NOTES-bind-9.11.0.html|title=Release Notes for BIND Version 9.11.0|date=2016-10-05}}</ref>
* [[Software:Knot DNS|Knot DNS]] from version 2.6.0.<ref>{{cite web|url=https://gitlab.labs.nic.cz/knot/knot-dns/tags/v2.6.0|title=Knot DNS 2.6.0|date=2017-09-29}}</ref>
* [[Company:Apple Inc.|Apple]]'s [[Software:IOS 9|iOS 9]] and OS X 10.11 both support TCP Fast Open, but it is not enabled for individual connections by default.<ref>{{cite web|url=https://developer.apple.com/videos/wwdc/2015/?id=719|title=Your App and Next Generation Networks|publisher=Apple Inc.|date=2015}}</ref>
* [[Software:Microsoft Edge|Microsoft Edge]] supports TCP Fast Open since [[Software:Windows 10|Windows 10]] Preview build 14352.<ref>{{cite web|url=https://developer.microsoft.com/en-us/microsoft-edge/platform/changelog/desktop/14352/|title=Windows 10 build 14352 - New web platform features|publisher=Microsoft|accessdate=2016-05-27}}</ref>
* [[Software:PowerDNS#Recursor|PowerDNS Recursor]] supports TCP Fast Open from version 4.1.<ref>{{cite web|url=https://doc.powerdns.com/recursor/changelog/4.1.html|title=Changelogs for 4.1.x|publisher=PowerDNS|date=2017-12-04}}</ref>
* [[Software:Dnsmasq|dnsmasq]] supports TCP-fastopen (RFC-7413) from version 2.81.<ref>{{cite web |url=http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=608aa9fcfca2ffeba40d78c7c4e0dcb50e0d5704 |title=Support TCP fastopen on incoming and outgoing connections. |last=Kelley |first=Simon |date=2019-03-10}}</ref>

== See also ==

* [[SPDY]]
* [[SYN cookies]]
* [[TCP Cookie Transactions]]
* 0-RTT
* [[QUIC]]

== References ==
{{Reflist|30em}}

== Bibliography ==

* {{ cite web | url = https://lwn.net/Articles/814522/ | title = A QUIC look at HTTP/3 | work = LWN.net | date = 13 March 2020 | last = Rybczyńska | first = Marta }}
* {{ Cite journal | arxiv = 1905.03518 | last1 = Sy | first1 = Erik | last2 = Mueller | first2 = Tobias | last3 = Burkert | first3 = Christian | last4 = Federrath | first4 = Hannes | last5 = Fischer | first5 = Mathias | title = Enhanced Performance and Privacy for TLS over TCP Fast Open | journal = Proceedings on Privacy Enhancing Technologies | year = 2020 | volume = 2020 | issue = 2 | pages = 271–287 | doi = 10.2478/popets-2020-0027 | doi-access = free }}

== External links ==
* {{IETF RFC|7413}} specification


{{Sourceattribution|TCP Fast Open|1}}