SSL_READ_EARLY_DATA(3)

💅 SSL_READ_EARLY_DATA(3) — like, the early data girlies (Library Functions Manual)

okay so bestie, buckle up, because this one is a whole situation. This page lives in the Library Functions Manual and it's about that one TLS feature everybody wants to talk about at parties: sending your app data during the handshake. Yes. Before you're even, like, properly introduced. 😭

---

✨ NAME ✨

So the whole squad of functions is:

• SSL_CTX_set_max_early_data
• SSL_set_max_early_data
• SSL_SESSION_set_max_early_data
• SSL_CTX_get_max_early_data
• SSL_get_max_early_data
• SSL_SESSION_get_max_early_data
• SSL_write_early_data
• SSL_read_early_data
• SSL_get_early_data_status

…and what they claim to do is transmit application data during the handshake. That's the vibe. That's the whole pitch. 🎀

---

🌸 SYNOPSIS 🌸

library “libssl” libcrypto #include <openssl/ssl.h>

int
SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_bytes);

int
SSL_set_max_early_data(SSL *ssl, uint32_t max_bytes);

int
SSL_SESSION_set_max_early_data(SSL_SESSION *session,
    uint32_t max_bytes);

uint32_t
SSL_CTX_get_max_early_data(const SSL_CTX *ctx);

uint32_t
SSL_get_max_early_data(const SSL *ssl);

uint32_t
SSL_SESSION_get_max_early_data(const SSL_SESSION *session);

int
SSL_write_early_data(SSL *ssl, const void *buf, size_t len,
    size_t *written);

int
SSL_read_early_data(SSL *ssl, void *buf, size_t maxlen,
    size_t *readbytes);

int
SSL_get_early_data_status(const SSL *ssl);

---

🦋 DESCRIPTION 🦋

okay. deep breath. In LibreSSL, these functions have no effect. Like, none. Zero. They exist purely because some applications out there expect the API to be available when TLSv1.3 is supported — so LibreSSL keeps the door open and the lights on, but nobody's home. 🙈

And honestly? Using them is strongly discouraged, and the reasons are giving very much "do not". Specifically:

• they provide, at best, marginal benefit even when they're fully implemented and used exactly as designed,
• they have absurdly complicated semantics (their words, not mine, but like… accurate),
• and when you do use them, the tiniest inconspicuous oversight is likely to cause serious security vulnerabilities. 💀

bestie, that's not a "read the docs later" warning, that's a "put it down and walk away" warning.

If these functions are used, other TLS implementations may allow the transfer of application data during the initial handshake. And even when everything is used exactly as designed, security of the connection is compromised — specifically:

• application data gets exchanged with unauthenticated peers,
• and there is no forward secrecy.

Other downsides include an increased risk of replay attacks. so like, the villain arc. 🫠

the setter girlies

SSL_CTX_set_max_early_data(), SSL_set_max_early_data(), and SSL_SESSION_set_max_early_data() are intended to configure the maximum number of bytes per session that can be transmitted during the handshake.

With LibreSSL, all arguments are ignored. iconic honestly. 💅

the writer

An endpoint can attempt to send application data with SSL_write_early_data() during the handshake.

With LibreSSL, such attempts always fail and set *written to 0. 😭

the reader

A server can attempt to read application data from the client using SSL_read_early_data() during the handshake.

With LibreSSL, no such data is ever accepted and *readbytes is always set to 0. 🙈

---

👑 RETURN VALUES 👑

• SSL_CTX_set_max_early_data(), SSL_set_max_early_data(), SSL_SESSION_set_max_early_data() — return 1 for success or 0 for failure. With LibreSSL, they always succeed.
• SSL_CTX_get_max_early_data(), SSL_get_max_early_data(), SSL_SESSION_get_max_early_data() — return the maximum number of bytes of application data that will be accepted from the peer during the handshake. With LibreSSL, they always return 0.
• SSL_write_early_data() — returns 1 for success or 0 for failure. With LibreSSL, it always fails.
• SSL_read_early_data() — with LibreSSL, it always returns SSL_READ_EARLY_DATA_FINISH on the server side and SSL_READ_EARLY_DATA_ERROR on the client side. SSL_READ_EARLY_DATA_SUCCESS can occur with other implementations, but not with LibreSSL.
• SSL_get_early_data_status() — with LibreSSL, it always returns SSL_EARLY_DATA_REJECTED. With other implementations, it might also return SSL_EARLY_DATA_NOT_SENT or SSL_EARLY_DATA_ACCEPTED.

---

💖 SEE ALSO 💖

• ssl(3)
• SSL_read(3)
• SSL_write(3)

go read those, they're the well-adjusted siblings. 🫶

---

🌈 STANDARDS 🌈

RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3:

1. Section 2.3 — 0-RTT data
2. Section 4.3.10 — Early Data Indication
3. Section 8 — 0-RTT and Anti-Replay
4. Appendix F.5 — Replay Attacks on 0-RTT

like, the receipt is right there in Appendix F.5 and it says replay attacks. ⭐

---

🎀 HISTORY 🎀

These functions first appeared in OpenSSL 1.1.1 and have been available since OpenBSD 7.0.

---

kisses bestie, that's the whole page 💋 this drop was from Debian, dated August 21, 2026, and yes the page name at the very bottom is SSL_READ_EARLY_DATA(3) — mwah 🍓✨