Re: [quicwg/base-drafts] Add Advice and Rules for CONN_CLOSE in Initial and Handshake (#1786)

[Kazuho Oku <[e-mail]>]

@ianswett 
> I'm not sure all epochs are necessary. Possibly "in the highest epoch the sender knows the peer can process and one higher if the peer may be able to process it." or something along those lines?

Yeah. The problem here is that the rule to determine "the highest epoch the peer can process" is complex and specific to TLS 1.3. IIRC that is one of the reasons we favored the explicit-ACK approach instead of the implicit- approach.

Anyways, the requirement here is that we need to at least state that the endpoints MUST send CONNECTION_CLOSE protected by a key that the peers established, if such key is available. Otherwise, peers trying to do their best against Initial packet injection attacks would not recognize the frame.

Perhaps stating something like the following might suffice; that for sending CONNECTION_CLOSE during handshake, an endpoint
* uses the Initial packet if it does not know the Handshake write key
* uses the Handshake packet if it has received a Handshake packet
* uses both the Initial packet and the Handshake packet if it has not received a Handshake packet but it knows the Handshake write key

The downside of the rule will be that the peers might not be able to drop Handshake keys as aggressively as the Initial keys. But IIUC that's fine from security perspective because Handshake packets are protected by the key agreement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1786#issuecomment-425766045