Re: [Emu] Issue 59 - Key Update

[Joseph Salowey <[e-mail]>]

On Mon, Apr 12, 2021 at 4:58 AM Alan DeKok <[e-mail]>
wrote:

> On Apr 11, 2021, at 10:40 PM, Joseph Salowey <[e-mail]> wrote:
> > This does seem to require some more specification.  Here is a proposal.
> >
> > "TLS 1.3 introduced the Post-Handshake KeyUpdate message which is not
> useful and not expected in EAP-TLS.  Implementations SHOULD NOT send a
> KeyUpdate message.  If a KeyUpdate message is received then an
> implementation SHOULD ignore the message and it SHOULD NOT send a KeyUpdate
> message in response."
> >
> > I think this is better than "implementations MUST NOT send this message
> and MUST fail upon reception".  The problem here is that the EAP TLS
> implementation may not have control over this behavior.
>
>   It looks like key update messages are explicitly requested by either
> party.  From OpenSSL:
>
>   https://www.openssl.org/docs/man1.1.1/man3/SSL_key_update.html
>
>   If the KeyUpdate message is sent only when requested, it would make
> sense to forbid sending it.  EAP-TLS has no reason to just randomly change
> the encryption keys used for TLS.  EAP-TLS is using TLS for authentication,
> and not for bulk data transfer.
>
>   If the underlying TLS library randomly sends it (or sends it subject to
> unknown criteria), then the EAP-TLS implementation (peer or authenticator)
> should be able to detect it via a callback:
>
> https://www.openssl.org/docs/man1.0.2/man3/SSL_set_msg_callback.html
>
>   There appears to be no way for the application to tell the TLS library
> to ignore the message.
>
>   The safest thing would seem to be:
>
> a) forbidding EAP-TLS implementations from explicitly requesting it
>
> b) noting that TLS libraries may still do key updates
>
> c) noting that EAP-TLS implementations can often detect key updates, and
>
> d) leaving it to the implementation to decide what to do.
>
>   i.e. "We don't know why you'd use it.  But if someone else does use it,
> and it works, great.  Otherwise, buyer beware".
>
>
[Joe] OK, this sounds reasonable to me.  How about text like the following:

"EAP-TLS implementations MUST NOT explicitly request key updates.  It is
possible that a TLS library implementation may automatically send a key
update message so an implementation detecting the reception of a keyUpdate
message MAY process or ignore the message since only a minimum amount of
application data is exchanged in the channel."


>   Alan DeKok.
>
>