Re: [quicwg/base-drafts] No reading of 1-RTT before the handshake is complete (#3224)

[Marten Seemann <[e-mail]>]

marten-seemann commented on this pull request.

I agree that this solves the issue **IF** implementations adhere to the spec.

A change of the key schedule that would make it impossible to use 1-RTT keys before the completion of the handshake would still be my preferred solution of this issue. I'm not sure if this isn't out of scope though.

>  - Any received 0-RTT data that the server responds to might be due to a replay
-attack.
-
-Therefore, the server's use of 1-RTT keys is limited before the handshake is
-complete.  A server MUST NOT process data from incoming 1-RTT
-protected packets before the TLS handshake is complete.  Because
-sending acknowledgments indicates that all frames in a packet have been
-processed, a server cannot send acknowledgments for 1-RTT packets until the
-TLS handshake is complete.  Received packets protected with 1-RTT keys MAY be
-stored and later decrypted and used once the handshake is complete.
+  attack.
+
+Therefore, the server's use of 1-RTT keys MUST be limited to sending data before
+the handshake is complete.  A server MUST NOT process data from incoming 1-RTT

Why not: "A server MUST NOT process incoming 1-RTT protected packets"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3224#pullrequestreview-315278261