Re: [quicwg/base-drafts] clarify that old keys should always be dropped (#2191)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.

I was going to suggest a few things, then I made https://github.com/marten-seemann/base-drafts/pull/1

> @@ -1108,16 +1108,11 @@ updated keys, it indicates that its peer has updated keys twice without awaiting
 a reciprocal update.  An endpoint MUST treat consecutive key updates as a fatal
 error and abort the connection.
 
-An endpoint SHOULD retain old keys for a short period to allow it to decrypt
-packets with smaller packet numbers than the packet that triggered the key
-update.  This allows an endpoint to consume packets that are reordered around
-the transition between keys.  Packets with higher packet numbers always use the
-updated keys and MUST NOT be decrypted with old keys.
-
-Keys and their corresponding secrets SHOULD be discarded when an endpoint has
-received all packets with packet numbers lower than the lowest packet number
-used for the new key.  An endpoint might discard keys if it determines that the
-length of the delay to affected packets is excessive.
+An endpoint SHOULD retain old keys for a short period, and discard them and
+the corresponding secrets afterwards.  This allows it to decrypt packets with
+smaller packet numbers than the packet that triggered the key update, which are
+reordered around the transition between keys.  Packets with higher packet

```suggestion
Packets with higher packet
```

> @@ -1108,16 +1108,11 @@ updated keys, it indicates that its peer has updated keys twice without awaiting
 a reciprocal update.  An endpoint MUST treat consecutive key updates as a fatal
 error and abort the connection.
 
-An endpoint SHOULD retain old keys for a short period to allow it to decrypt
-packets with smaller packet numbers than the packet that triggered the key
-update.  This allows an endpoint to consume packets that are reordered around
-the transition between keys.  Packets with higher packet numbers always use the
-updated keys and MUST NOT be decrypted with old keys.
-
-Keys and their corresponding secrets SHOULD be discarded when an endpoint has
-received all packets with packet numbers lower than the lowest packet number
-used for the new key.  An endpoint might discard keys if it determines that the
-length of the delay to affected packets is excessive.
+An endpoint SHOULD retain old keys for a short period, and discard them and
+the corresponding secrets afterwards.  This allows it to decrypt packets with
+smaller packet numbers than the packet that triggered the key update, which are

```suggestion
that were sent with the old keys, but were delayed in the network.
```

> @@ -1108,16 +1108,11 @@ updated keys, it indicates that its peer has updated keys twice without awaiting
 a reciprocal update.  An endpoint MUST treat consecutive key updates as a fatal
 error and abort the connection.
 
-An endpoint SHOULD retain old keys for a short period to allow it to decrypt
-packets with smaller packet numbers than the packet that triggered the key
-update.  This allows an endpoint to consume packets that are reordered around
-the transition between keys.  Packets with higher packet numbers always use the
-updated keys and MUST NOT be decrypted with old keys.
-
-Keys and their corresponding secrets SHOULD be discarded when an endpoint has
-received all packets with packet numbers lower than the lowest packet number
-used for the new key.  An endpoint might discard keys if it determines that the
-length of the delay to affected packets is excessive.
+An endpoint SHOULD retain old keys for a short period, and discard them and
+the corresponding secrets afterwards.  This allows it to decrypt packets with

```suggestion
the corresponding secrets afterwards.  This allows it to decrypt packets
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2191#pullrequestreview-185424401