Re: [quicwg/base-drafts] Use the same KDF regardless of TLS version (#2034)

[Kazuho Oku <[e-mail]>]

FWIW, I tend to agree @martinthomson that always using the TLS 1.3 HKDF for packet protection is simpler.

I can see that the TLS-version-independent construction required by #2032 can be complex depending on the TLS stack (to be honest, it would be complex in picotls too, unless we create a API like the one in 
https://github.com/quicwg/base-drafts/pull/2034#issuecomment-440570473). OTOH, it is uncertain if we would gain anything from a HKDF construction that's trying to be version-independent, there's no guarantee that the future versions of TLS uses a KDF that is API-compatible with that of TLS 1.3.

Therefore, I am not against mandating the use of TLS "1.3" HKDF for QUICv1. The only complaint I have is that, then, we do not need the "tls13 " prefix. Having it is not bad by itself, but imposes an unnecessary change to the implementors.

I feel sorry for the asking the editors to revert #1991 after spending an effort on it. But I am not sure if we can convince that the implementors #1991 is a necessary change if we adopt the text of this PR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2034#issuecomment-440798186