Re: [quicwg/base-drafts] Rewrite key update section (#3050)

[Kazuho Oku <[e-mail]>]

kazuho requested changes on this pull request.



>  
-The KEY_PHASE bit allows a recipient to detect a change in keying material
-without necessarily needing to receive the first packet that triggered the
-change.  An endpoint that notices a changed KEY_PHASE bit can update keys and
-decrypt the packet that contains the changed bit.
+The Key Phase bit indicates which packet protection keys are used to protect the
+packet.  The Key Phase bit is initially set to 0 for the first set of 1-RTT
+packets and toggled to signal each subsequent key update.

I think that this sentence, along with the sentence stating that "an endpoint MUST NOT initiate a key update prior to having received an acknowledgment for a packet that it sent protected with keys from the current key phase" is introducing a design change.

At the moment, we allow the first key update to be executed when the handshake is confirmed, while prohibiting subsequent key updates happening before receiving an ACK for the preceding key update. That has meant that if an endpoint were to send its first 1-RTT packet after the handshake has been confirmed could send the first 1-RTT packet with the Key Phase bit set to 1. The new text prohibits that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3050#pullrequestreview-310322927