[quicwg/base-drafts] Re-visit initial keys discard (#2741)

[ekr <[e-mail]>]

This was prematurely closed and got kicked out of the design team.

Here's my proposal for how to handle this
I propose that we apply effectively the same algorithm as elsewhere: you discard initial keys when you get an ACK for a packet that was sent with the handshake key

On the server side, this will generally be at the same time, because the server will likely bundle Initial and Handshake packets, and therefore the clients' second flight will contain the ACK for the server's first handshake packet.

On the client side, it is 1-RTT later, but for the reasons I argued in the meeting, I don't think that this changes the situation: an attacker who occupies a position between the client and the server can forge a bogus partial first server flight to the client faster than the server responds. Then, as required by the current spec language, the client will discard the Initial key and be unable to receive anything from the true server, so there is already a DoS, which is not made significantly worse by the proposal above.

As Kazuho has pointed out you can do better than this by keeping multiple candidate server flights, but that's extratextual, and would be in violation of the language you quote above. I suppose if we wanted to do better, we could require:

1. The server to drop keys when it receives a handshake ACK.
2. The client to drop keys on handshake complete

But this seems more complicated.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2741