Re: [quicwg/base-drafts] Receiver's behavior on key update (#2791)

[David Schinazi <[e-mail]>]

I like the new text about send keys, thanks @kazuho !

However, the change from
> Endpoints MAY limit the number of keys they retain to two sets

to
>an endpoint SHOULD retain at least two receive keys

is not as obvious to me.

The algorithm you describe actually uses 3 receive keys: you have the old one, the current one, and the new one. The new algorithm only overwrites the old keys with the new ones if decryption succeeds, which requires keeping 3 keys in memory while you're decrypting. The minimal algorithm immediately overwrites the old key when receiving the new packet, and that only requires keeping two keys in memory. It's not possible for this to work safely while only saving one set of keys. That's why the old text mentioned that you MAY go as low as 2, but it's not possible to go lower. If you want to change the phrasing, then this should be a MUST as opposed to a SHOULD. Perhaps MUST >= 2, SHOULD >= 3 and then you describe the 3-key algorithm? But then we'd probably want to also describe the 2-key algorithm.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2791#issuecomment-502755865