Re: [quicwg/base-drafts] Rework Key Update (#2237)

[Marten Seemann <[e-mail]>]

marten-seemann commented on this pull request.



> @@ -1098,50 +1098,23 @@ anticipation of receiving a ClientHello.
 # Key Update
 
 Once the 1-RTT keys are established and the short header is in use, it is
-possible to update the keys. The KEY_PHASE bit in the short header is used to
-indicate whether key updates have occurred. The KEY_PHASE bit is initially set
-to 0 and then inverted with each key update.
+possible to update the keys used to protect packets. The Key Phase bits in the
+short header are used to indicate whether key updates have occurred. The
+Key Phase is initially set to 0 and then incremented with each key update.

Incremented % 4

>  
-The KEY_PHASE bit allows a recipient to detect a change in keying material
-without necessarily needing to receive the first packet that triggered the
-change.  An endpoint that notices a changed KEY_PHASE bit can update keys and
-decrypt the packet that contains the changed bit.
+The Key Phase allows a recipient to detect a change in keying material
+without needing to receive the first packet that triggered the change.  An
+endpoint that notices a changed Key Phase bit can update keys and decrypt the

If we want to be able to force the peer to update its keys, shouldn’t this be a MUST?

> +An endpoint MUST NOT initiate more than one key update at a time.  A new key
+cannot be used until the endpoint has received an indication that its peer is
+using the same key phase.
+
+An endpoint that receives a packet protected with old keys that includes an
+acknowledgement for a packet protected with newer keys MAY treat that as a
+connection error of type PROTOCOL_VIOLATION.
+
+
+## Responding to a Key Update
+
+A receiving endpoint detects an update when the Key Phase is one greater than
+what it is expecting.  The endpoint creates a new read secret and the
+corresponding read key and IV using the same process as its peer.
+
+A packet with a Key Phase other than the expected or next value MUST be

The previous one is ok as well, as long as it’s sent with a smaller packet number. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2237#pullrequestreview-187285207