Re: [quicwg/base-drafts] Do Initial secrets change after Retry packet? (#2823)

[Kazuho Oku <[e-mail]>]

@nharper Maybe I am wrong, but haven't we had interop based on the understanding that the 2 is the correct way (i.e. the "S" column of the interop matrix)?

> (From the discussion in #2180, it sounds like an Initial sent in response to a Retry is still the same connection.)

IIUC, the discussion is about "cryptographic handshake message" (i.e. ClientHello transmitted as the payload of the CYRPTO frame) being consistent. Not about the key that encrypts (obfuscates) the frames.

One practical issue with option 1 is that it requires the server and the issuer of the Retry token to share the format of the Retry token (as well as a secret key to extract ODICID from the token in certain designs). IIRC, our previous consensus is to permit people to install DDoS mitigation boxes that issue Retry packets, without requiring such coordination between those mitigation boxes and the servers being protected (@nibanks am I correct?)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-504809515