Re: [quicwg/base-drafts] Use the same KDF regardless of TLS version (#2034)

[Martin Thomson <[e-mail]>]

The intent was always to permit negotiation of newer TLS versions.  That's an easy fix.

However, this discussion goes to the core of what the interface between QUIC and TLS is.  The stream0 contract, as I understood it, was that TLS would pass secrets to QUIC.  This is why we changed so that the invasive change to the TLS KDF was not allowed.  QUIC is responsible for taking those secrets and turning them into keys and IVs.

It seems like people are arguing here that the TLS KDF is also part of the contract.  As an implementation convenience, that's fine, but I don't think that's a good idea.  It means that we have inconsistent use of KDFs within QUIC (TLS 1.3 for initial keys, TLS X for other keys), and it means that the API contract is tighter.

If your QUIC stack wants to use the TLS KDF, that's fine, but this binds the call to the negotiated TLS version.  You can't just call `tls13_kdf(secret, label, L)`, you have to build `tls_kdf(tls_socket, secret, label, L)`, AND you still need the other API for initial secrets.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2034#issuecomment-441129242