Re: [quicwg/base-drafts] Describe inputs to TLS more clearly (#4011)

[Jana Iyengar <[e-mail]>]

@janaiyengar commented on this pull request.



> -available.  If the keys are generated asynchronously, an endpoint MAY continue
-responding to the received packets that were processable while waiting for TLS
-to provide these keys.
+QUIC that reading or writing keys at that encryption level are available.
+
+The events that cause new keys to be available are not asynchronous; they
+always occur after TLS is provided with inputs. TLS only provides new keys
+after being initialized (by a client) or after being provided with new
+handshake data.
+
+However, a TLS implementation could perform some of its processing
+asynchronously. In particular, the process of validating a certificate can take
+some time. While waiting for TLS processing to complete, an endpoint SHOULD
+buffer received packets if they might be processed using keys that aren't yet
+available. These packets can be processed once keys are provided by TLS. An
+endpoint MAY continue to respond to packets that can be processed during this

This text comes from #3874. @ianswett did [raise this exact point there](https://github.com/quicwg/base-drafts/pull/3874/commits/f851c8c09372918c9b735053084707f24f066547#r468890923), and I argued that it wasn't necessary to make this a SHOULD.

As I look at the text again, I think I was wrong in pushing back then. The intent was to have the receiver buffer and respond, so I think it actually making this a SHOULD expresses that intent better.

> @@ -499,12 +499,23 @@ handshake, new data is requested from TLS after providing received data.
 ### Encryption Level Changes
 
 As keys at a given encryption level become available to TLS, TLS indicates to
-QUIC that reading or writing keys at that encryption level are available.  While
-generating these keys, an endpoint SHOULD buffer received packets marked as
-protected by the keys being generated, and process them once those keys become
-available.  If the keys are generated asynchronously, an endpoint MAY continue
-responding to the received packets that were processable while waiting for TLS
-to provide these keys.
+QUIC that reading or writing keys at that encryption level are available.
+
+The events that cause new keys to be available are not asynchronous; they

I think dropping "asynchronous" from this sentence is fine -- the next para holds up well in describing what asynchronous actually means.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4011#discussion_r483837120