[quicwg/base-drafts] Handshake failure after Retry (#1784)

[Tatsuhiro Tsujikawa <[e-mail]>]

I found that there is a corner case that handshake fails after Retry.
The current specification allows server not to change its SCID in Retry packet.  In other words, server is allowed to set client chosen CID in SCID field of Retry packet.
The spec also allows client to create fresh TLS context each time it receives Retry packet.
If they are used, there is a case that handshake fails after Retry packet.
Here is the possible scenario.

1. client sends Initial to server with TLS context T0: Initial SCID=A DCID=B
2. client resends Initial to server with TLS context T0: Initial SCID=A DCID=B
3. client receives Retry from server: Retry SCID=B DCID=A ODCID=B
4. in response to Retry(3), client sends Initial to server with TLS context T1: Initial SCID=A DCID=B
5. client receives Retry from server (in response to client Initial(2)): Retry SCID=B DCID=A ODCID=B ODCID=B
6. in response to Retry(5), client sends Initial to server with TLS context T2: Initial SCID=A DCID=B
7. client receives Initial from server (in response to client Initial(4), thus using TLS context T1): Initial SCID=C DCID=A
8. client receives Handshake from server (which uses TLS context T1): Handshake SCID=C DCID=A

client cannot decrypt Handshake packet from server because client uses TLS context T2 meanwhile server uses TLS context T1.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1784