Date: Wed, 15 Jul 2020 18:26:05 -0700
From: Martin Thomson <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+AFTOJK4QUJ74IFPEWNJYEQF5DOG23EVBNHHCN3BEFQ@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/3868/review/449446252@github.com>
In-Reply-To: <quicwg/base-drafts/pull/3868@github.com>
References: <quicwg/base-drafts/pull/3868@github.com>
Subject: Re: [quicwg/base-drafts] Prohibit reading 1-RTT before handshake
 complete (#3868)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5f0facad1789f_35f83f8943ccd95c997dd";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/TVqP7p-Gj5FPMLNET2oZYfkYRCw>


----==_mimepart_5f0facad1789f_35f83f8943ccd95c997dd
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

@martinthomson commented on this pull request.



> @@ -1280,6 +1280,10 @@ A server could receive packets protected with 0-RTT keys prior to receiving a
 TLS ClientHello.  The server MAY retain these packets for later decryption in
 anticipation of receiving a ClientHello.
 
+A client generally receives 1-RTT keys at the same time as the handshake
+completes.  However, a client also MUST NOT process incoming 1-RTT protected
+packets before the TLS handshake is complete.

Note the "generally".  It is - in theory - possible for a client to receive keys for TLS before it has completed the handshake.  The simplest example is that the client has all the messages necessary, but the server certificate hasn't been authenticated yet (which is a condition for handshake completion).  As certificate authentication can take time, there is potentially a time where the client could generate keys and use them without being sure of what the server identity is.  Most TLS stacks don't allow that to happen, but it isn't a guarantee that is made anywhere.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526
----==_mimepart_5f0facad1789f_35f83f8943ccd95c997dd
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<p></p>
<p><b>@martinthomson</b> commented on this pull request.</p>

<hr>

<p>In <a href="https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526">draft-ietf-quic-tls.md</a>:</p>
<pre style='color:#555'>&gt; @@ -1280,6 +1280,10 @@ A server could receive packets protected with 0-RTT keys prior to receiving a
 TLS ClientHello.  The server MAY retain these packets for later decryption in
 anticipation of receiving a ClientHello.
 
+A client generally receives 1-RTT keys at the same time as the handshake
+completes.  However, a client also MUST NOT process incoming 1-RTT protected
+packets before the TLS handshake is complete.
</pre>
<p>Note the "generally".  It is - in theory - possible for a client to receive keys for TLS before it has completed the handshake.  The simplest example is that the client has all the messages necessary, but the server certificate hasn't been authenticated yet (which is a condition for handshake completion).  As certificate authentication can take time, there is potentially a time where the client could generate keys and use them without being sure of what the server identity is.  Most TLS stacks don't allow that to happen, but it isn't a guarantee that is made anywhere.</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AFTOJK34Z4P52RXDZ74EOG3R3ZJK3ANCNFSM4OUG3SDQ">unsubscribe</a>.<img src="https://github.com/notifications/beacon/AFTOJK44IZAQSYP27KUU3STR3ZJK3A5CNFSM4OUG3SD2YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGODLFAC3A.gif" height="1" width="1" alt="" /></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526",
"url": "https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526",
"name": "View Pull Request"
},
"description": "View this Pull Request on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>
----==_mimepart_5f0facad1789f_35f83f8943ccd95c997dd--