[quicwg/base-drafts] simultaneous key update can lead to deadlock (#2214)

[Marten Seemann <[e-mail]>]

Imagine the following (somewhat contrived) situation:

1. The peers are currently both sending with key phase 0, and simultaneously and independently decide that it's time for a key update. They both derive the new keys for the next key phase, and start sending packets with key phase 1.
2. Peer B receives one of the packets with key phase 1. It (incorrectly) concludes that A received one of its key phase 1 packets, and initiates the next key update, and continues sending packets with key phase 0.
3. All packets with key phase 1 sent by B are lost. A now receives the new packets with key phase 0 sent by B. Since it didn't receive any key phase 1 packets, it doesn't derive new keys, and tries to decrypt the packets with the old key phase 0 key. All of those packets will end up undecrytable, leading to a stalling of the connection.
4. There's nothing A can do to recover from this situation (other than trial decryption). If it continues to send key phase 1 packets, B will interpret this as yet another key update.

One might argue that it's improbable that *all* packets with a certain key phase are lost, and certainly the probability decreases with the number of packets sent in one key phase. However, there's nothing in the spec that prevents a peer from rotating keys as frequently as it is allowed to (i.e. directly after receiving a single packet with a matching key phase).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2214