Re: [quicwg/base-drafts] Rewrite key update section (#3050)

[David Schinazi <[e-mail]>]

DavidSchinazi approved this pull request.

Thanks for adding back the implementation text. I like the new text.

I would personally prefer to see all the timing side-channel text in its own subsection, because it makes the more important part of the spec harder to read, and I don't see this attack as important enough to warrant worrying about when trying to understand key updates.

> +An endpoint SHOULD retain old keys so that packets sent by its peer prior to
+receiving the key update can be processed.  Discarding old keys too early can
+cause delayed packets to be discarded.  Discarding packets will be interpreted
+as packet loss by the peer and could adversely affect performance.
+
+
+## Responding to a Key Update
+
+A peer is permitted to initiate a key update after receiving an acknowledgement
+of a packet in the current key phase.  If a packet is received with a key phase
+that differs from the value the endpoint used to protect the last packet it
+sent, the endpoint uses the next packet protection keys for reading and the
+corresponding key and IV; see {{receive-key-generation}} for considerations
+about generating these keys.
+
+An endpoint uses the same key derivation process as its peer uses to generate

I'm not parsing this sentence well. What does it mean?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3050#pullrequestreview-310218613