Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769)

[Martin Thomson <[e-mail]>]

On 12 February 2017 at 09:26, Andrey Jivsov <[e-mail]> wrote:
> How should an implementer read [0]? If an implementation sends or receives
> shorter records, it has to re-key sooner.

[0] (the current text) says that there is a maximum number of records.
That's pretty straightforward.  You are required to count them anyway.
No accounting for partial records and other such things.

If that means rekeying sooner, I'd like evidence that this is in some
way harmful.  I think that it's fine.

I'm not disagreeing with the notion of correctness that has been
discussed on this thread and elsewhere, just offering a different set
of criteria upon which you might make this decision.

Ilari made a related point: if you don't rekey occasionally, you might
as well just forget the whole mechanism.  Given the actual limit - for
even the most conservative option, [0] - is so large that common usage
will never hit it, that means rekeying even more often than any
idealized 2^52 octets.