Re: [quicwg/base-drafts] forbid key discarding before receiving a packet protected with new keys (#4079)

[Martin Thomson <[e-mail]>]

@martinthomson commented on this pull request.



> @@ -1496,10 +1496,11 @@ The endpoint that initiates a key update also updates the keys that it uses for
 receiving packets.  These keys will be needed to process packets the peer sends
 after updating.
 
-An endpoint SHOULD retain old keys so that packets sent by its peer prior to
-receiving the key update can be processed.  Discarding old keys too early can
-cause delayed packets to be discarded.  Discarding packets will be interpreted
-as packet loss by the peer and could adversely affect performance.
+An endpoint MUST retain old keys until it has successfully unprotected a packet
+sent using the new keys.  An endpoint SHOULD NOT discard old keys immediately
+after unprotecting a packet sent using the new keys.  Discarding old keys too
+early can cause delayed packets to be discarded.  Discarding packets will be
+interpreted as packet loss by the peer and could adversely affect performance.

Yes, it's safe to drop key N when you receive packets protected with key N+1.  And it's true that keeping keys for a short while helps avoid dropping reordered packets.

However, it it generally safer to only drop key N when you receive an acknowledgment for a packet sent with N+1 keys.  Because the other side might have updated on its own.  That means that the N+1 packet you received isn't any indication that they received your key update.  This distinction doesn't matter for dropping keys, but it does matter for determining whether you can initiate an update to N+2 keys later.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4079#discussion_r485321502