[quicwg/base-drafts] Justification for Key Separation doesn't make sense (#2447)

[martinduke <[e-mail]>]

In section 9.4 of the TLS draft:

> In using TLS, the central key schedule of TLS is used. As a result of the TLS handshake messages being integrated into the calculation of secrets, the inclusion of the QUIC transport parameters extension ensures that handshake and 1-RTT keys are not the same as those that might be produced by a server running TLS over TCP. However, 0-RTT keys only include the ClientHello message and might therefore use the same secrets. To avoid the possibility of cross-protocol key synchronization, additional measures are provided to improve key separation.

To a naive reader like me,  this doesn't make any sense.  Handshake and 1RTT keys are fine because they hash the transport parameters. If 0-RTT keys include the ClientHello, they also contain transport parameters. So what's the problem?


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2447