Re: [quicwg/base-drafts] Output of the discard keys design team (#2673)

[David Schinazi <[e-mail]>]

DavidSchinazi commented on this pull request.



> -cannot be used until the endpoint has received and successfully decrypted a
-packet with a matching KEY_PHASE.
+An endpoint MUST NOT initiate the first key update until the handshake is
+confirmed ({{handshake-confirmed}}). An endpoint MUST NOT initiate a subsequent
+key update until it has received an ACK for a packet sent at the previous
+KEY_PHASE.  This can be implemented by tracking the lowest packet number sent
+with the previous KEY_PHASE, and the highest value of the Largest Acknowledged
+field in any received 1-RTT ACK frame: once the latter is higher than the
+former, another key update can be initiated.
+
+Endpoints only need to maintain the two latest sets of packet protection keys
+and MAY discard older keys.  Updating keys multiple times rapidly can cause
+packets to be effectively lost if packets are significantly delayed.
+Therefore, an endpoint SHOULD NOT initiate a key update until three times the
+PTO after it has last updated keys. This avoids valid reordered packets being
+dropped by the peer because the peer could have discarded older keys.

Fixed

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2673#discussion_r281874731