Re: [quicwg/base-drafts] forbid key discarding before receiving a packet protected with new keys (#4079)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> @@ -1496,10 +1496,11 @@ The endpoint that initiates a key update also updates the keys that it uses for
 receiving packets.  These keys will be needed to process packets the peer sends
 after updating.
 
-An endpoint SHOULD retain old keys so that packets sent by its peer prior to
-receiving the key update can be processed.  Discarding old keys too early can
-cause delayed packets to be discarded.  Discarding packets will be interpreted
-as packet loss by the peer and could adversely affect performance.
+An endpoint MUST retain old keys until it has successfully unprotected a packet
+sent using the new keys.  An endpoint SHOULD NOT discard old keys immediately
+after unprotecting a packet sent using the new keys.  Discarding old keys too
+early can cause delayed packets to be discarded.  Discarding packets will be
+interpreted as packet loss by the peer and could adversely affect performance.

I'm not sure if I agree.

As @marten-seemann points out, an endpoint that only receives data (but does not send any) might decide to do a key update. If that endpoint drops the old receive key before any of the packets _it_ sent reaches the peer, the connection will be stuck.

That is because all the ack-eliciting packets involved will be the ones that are sent by the peer using the old key, which the endpoint has dropped that key.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4079#discussion_r485235463