Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769)

[Andrey Jivsov <[e-mail]>]

On 02/12/2017 01:44 AM, Martin Thomson wrote:
> On 12 February 2017 at 09:26, Andrey Jivsov <[e-mail]> wrote:
>> How should an implementer read [0]? If an implementation sends or receives
>> shorter records, it has to re-key sooner.
>
> [0] (the current text) says that there is a maximum number of records.
> That's pretty straightforward.  You are required to count them anyway.
> No accounting for partial records and other such things.
>
> If that means rekeying sooner, I'd like evidence that this is in some
> way harmful.  I think that it's fine.
>
> I'm not disagreeing with the notion of correctness that has been
> discussed on this thread and elsewhere, just offering a different set
> of criteria upon which you might make this decision.
>
> Ilari made a related point: if you don't rekey occasionally, you might
> as well just forget the whole mechanism.  Given the actual limit - for
> even the most conservative option, [0] - is so large that common usage
> will never hit it, that means rekeying even more often than any
> idealized 2^52 octets.
>

I don't disagree with the above.

If the stack shares code with 3DES, that code will probably count in 
bytes. This logic can be reused with TLS 1.3. Then the code can be 
tested with 3DES.