Re: [quicwg/base-drafts] Add Advice and Rules for CONN_CLOSE in Initial and Handshake (#1786)

[Martin Thomson <[e-mail]>]

> Update Sec 4.1.1 of the TLS draft (@mikkelfj 's find above) to allow quietly dropping the packet when CRYPTO overruns.

Seems reasonable, as a MAY.

> Silently drop packets with CONN_CLOSE if we have received a higher encryption level from the peer.

Mostly OK, but you might have already processed some frames when you hit the CONNECTION_CLOSE.  We'd need to address that.

> When closing the connection, send CONNECTION_CLOSE with the latest keys you have. If you haven't received a packet with those keys yet, also send with the previous keys.

Send with the keys you know that your peer has.  That is, if you have received X, send with X.  You might already be sending with X+1, but it isn't always guaranteed that your peer has X+1.  For instance, the server might be sending Handshake packets, but the client might not have processed all of the Initial yet.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1786#issuecomment-425265494