Re: [quicwg/base-drafts] Deny 1-RTT Rx keys till finished (#3174)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.

Thank you for the PR. I agree that giving a warning to the implementors in the QUIC-TLS draft is the right choice.

I am fine with the PR aside from the editorial concern below.

> @@ -504,6 +504,9 @@ client could interleave ACK frames that are protected with Handshake keys with
 0-RTT data and the server needs to process those acknowledgments in order to
 detect lost Handshake packets.
 
+A TLS implementation MUST NOT provide a 1-RTT decrypt secret to QUIC until it
+the TLS handshake is complete.

As stated in https://github.com/quicwg/base-drafts/issues/3173#issuecomment-548222995, I do not think we should be using a normative word here, as this is a requirement in the TLS 1.3 handshake protocol (specifycally the one stated in [section 4.4.4](https://tools.ietf.org/html/rfc8446#section-4.4.4)).

QUIC is a user of the TLS handshake protocol (like DTLS 1.3), and we should not repeat what the TLS handshake protocol already requires you to do.

That said, I am fine with editors making the choice.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3174#pullrequestreview-310201499