Re: [quicwg/base-drafts] Prohibit reading 1-RTT before handshake complete (#3868)

[Martin Thomson <[e-mail]>]

@martinthomson commented on this pull request.



> @@ -1280,6 +1280,10 @@ A server could receive packets protected with 0-RTT keys prior to receiving a
 TLS ClientHello.  The server MAY retain these packets for later decryption in
 anticipation of receiving a ClientHello.
 
+A client generally receives 1-RTT keys at the same time as the handshake
+completes.  However, a client also MUST NOT process incoming 1-RTT protected
+packets before the TLS handshake is complete.

Note the "generally".  It is - in theory - possible for a client to receive keys for TLS before it has completed the handshake.  The simplest example is that the client has all the messages necessary, but the server certificate hasn't been authenticated yet (which is a condition for handshake completion).  As certificate authentication can take time, there is potentially a time where the client could generate keys and use them without being sure of what the server identity is.  Most TLS stacks don't allow that to happen, but it isn't a guarantee that is made anywhere.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526