Re: [quicwg/base-drafts] Make EOED transmission optional in QUIC, please (#1518)

[Victor Vasiliev <[e-mail]>]

> I don't think the main issue is compatibility with the existing TLS implementations but rather (a) having consistency with TLS

The point I was trying to make is that EOED is not logically part of TLS handshake protection (which we're trying to preserve in order to rely on security properties proven in multiple analyses), but rather of TLS record layer.  We're pretty much rolling our own record layer, which means it befalls on us to ensure its security ourselves.  That does not itself mean we should drop EOED by itself, merely that we actually *have* to decide something without pointing fingers to TLS 1.3 :)

Regarding your attack, if you're concerned about 0-RTT keys being compromised after EOED, wouldn't you want to drop them as soon as possible?  As it stands, the client can't do it because it has to hold onto them for retransmitting EOED.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1518#issuecomment-417992450