Re: [quicwg/base-drafts] Rework Key Update (#2237)

[Marten Seemann <[e-mail]>]

marten-seemann commented on this pull request.



> @@ -1101,75 +1101,153 @@ anticipation of receiving a ClientHello.
 # Key Update
 
 Once the 1-RTT keys are established and the short header is in use, it is
-possible to update the keys. The KEY_PHASE bit in the short header is used to
-indicate whether key updates have occurred. The KEY_PHASE bit is initially set
-to 0 and then inverted with each key update.
+possible to update the keys used to protect packets. The Key Update field in the
+short header are used to indicate when key updates are permitted and when they

s/are/is/

>  
 This mechanism replaces the TLS KeyUpdate message.  Endpoints MUST NOT send a
 TLS KeyUpdate message.  Endpoints MUST treat the receipt of a TLS KeyUpdate
 message as a connection error of type 0x10a, equivalent to a fatal TLS alert of
 unexpected_message (see {{tls-errors}}).
 
-An endpoint MUST NOT initiate more than one key update at a time.  A new key
-cannot be used until the endpoint has received and successfully decrypted a
-packet with a matching KEY_PHASE.
+{{ex-key-update}} shows a key update process, with keys used identified with @M
+and @N.  Values in brackets [] indicate the value of Key Update bits.
+
+~~~
+   Initiating Peer                    Responding Peer
+
+@M [10] QUIC Packets
+. Update to @N
+@N [01] QUIC Packets
+                      -------->
+                                     QUIC Packets [10] @M

Why is this line here? The responding peer should update the keys immediately when receiving the first @N packet.

>  
-The KEY_PHASE bit allows a recipient to detect a change in keying material
-without necessarily needing to receive the first packet that triggered the
-change.  An endpoint that notices a changed KEY_PHASE bit can update keys and
-decrypt the packet that contains the changed bit.
+The the low bit of the Key Update field (0x04) is the Key Phase bit.  The Key
+Phase is used to indicate which packet protection keys are in use.  The Key

Maybe better: "which packet protection key was used to protect this packet."

>  
-If the packet can be decrypted and authenticated using the updated key and IV,
-then the keys the endpoint uses for packet protection are also updated.  The
-next packet sent by the endpoint will then use the new keys.
+The endpoint uses the key and IV to protect all subsequent packets, clears the
+Key Update Permitted bit, and toggles the value of the low Key Phase bit.

This sentence reads better if you turn it around and insert an "updated": "The endpoint clears the Key Update Permitted bit, and toggles the value of the low Key Phase bit, and uses the updated key and IV to protect all subsequent packets."

>  
-If the packet can be decrypted and authenticated using the updated key and IV,
-then the keys the endpoint uses for packet protection are also updated.  The
-next packet sent by the endpoint will then use the new keys.
+The endpoint uses the key and IV to protect all subsequent packets, clears the
+Key Update Permitted bit, and toggles the value of the low Key Phase bit.
+
+An endpoint MUST NOT initiate more than one key update at a time.  A new key
+cannot be used until the endpoint has successfully processed a packet with a

Better: A subsequent key update can only be performed once the endpoint...

>  
-If the packet can be decrypted and authenticated using the updated key and IV,
-then the keys the endpoint uses for packet protection are also updated.  The
-next packet sent by the endpoint will then use the new keys.
+The endpoint uses the key and IV to protect all subsequent packets, clears the
+Key Update Permitted bit, and toggles the value of the low Key Phase bit.
+
+An endpoint MUST NOT initiate more than one key update at a time.  A new key
+cannot be used until the endpoint has successfully processed a packet with a
+matching Key Phase and the Key Update Permitted bit set.  Together, these
+indicate that the key update was received and acted on.
+
+Once an endpoint has received and successfully processed packets with the same
+Key Phase value, this indicates that the peer has also updated keys.  The
+endpoint can then set the Key Update Permitted bit to 1 on packets it

I'd prefer stronger language here. Ideally, a MUST (although we'd have to rearrange the text a bit to allow deferring this until the old keys are discarded).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2237#pullrequestreview-190578232