What is TCP Fast Open and what trade-offs does it introduce?

• A. It allows sending data with the SYN to reduce handshake latency; trade-offs include certain security considerations and complexity.
• B. It always fails.
• C. It reduces security to zero.
• D. It prevents future connections.

Answer: (A)

TCP Fast Open lets data be sent with the initial SYN, so the connection can start transferring data without waiting for a full round-trip of the handshake. This speeds up the setup by effectively saving one RTT, which can noticeably reduce latency for short-lived connections.

To make this possible, the server opt-in uses a cryptographic cookie mechanism: when a client first connects, the server issues a cookie that the client stores and presents in subsequent attempts. If the cookie is valid, the server allows data to be sent in the SYN for that new connection. This reduces handshake latency, but introduces trade-offs. There are security concerns because the data in the SYN isn’t protected by the application-layer encryption (for example, TLS) until the handshake completes, and there’s potential for replay or abuse if cookie handling isn’t robust. The approach also adds complexity and server-side state to manage cookies and track TFO-enabled clients, and not all networks or middleboxes handle TFO reliably, which can affect compatibility and reliability.

So, it’s about speeding up the initial data transfer by piggybacking on the SYN, with security considerations and implementation complexity as the main trade-offs.