Re: [quicwg/base-drafts] forbid key discarding before receiving a packet protected with new keys (#4079)

[Marten Seemann <[e-mail]>]

@marten-seemann commented on this pull request.



> @@ -1496,10 +1496,11 @@ The endpoint that initiates a key update also updates the keys that it uses for
 receiving packets.  These keys will be needed to process packets the peer sends
 after updating.
 
-An endpoint SHOULD retain old keys so that packets sent by its peer prior to
-receiving the key update can be processed.  Discarding old keys too early can
-cause delayed packets to be discarded.  Discarding packets will be interpreted
-as packet loss by the peer and could adversely affect performance.
+An endpoint MUST retain old keys until it has successfully unprotected a packet
+sent using the new keys.  An endpoint SHOULD NOT discard old keys immediately
+after unprotecting a packet sent using the new keys.  Discarding old keys too
+early can cause delayed packets to be discarded.  Discarding packets will be
+interpreted as packet loss by the peer and could adversely affect performance.

> However, it it generally safer to only drop key N when you receive an acknowledgment for a packet sent with N+1 keys.

That's correct. In my mental model (and in my implementation), these are two separate conditions though. I can start the timer to drop the keys before I'm allowed to update to N+2.

Do you think we need to make any changes to this text here?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4079#discussion_r485332383