Re: Key updates

[Martin Thomson <[e-mail]>]

On Mon, Aug 6, 2018 at 10:43 PM Ian Swett <[e-mail]> wrote:
> I think we seriously considered the option of "Close the connection and 0RTT a new one".

Yes, and the TLS working group did too.  This is what we got.

I implemented a limit to the number of records we send in TLS and
haven't heard a complaint (even though we have non-trivial numbers of
DES connections, where the limit is fairly low).  Which suggests that
this might be an OK strategy... for the web.

However, I also know that people were using h2 for things like
connections between gateways and origin servers and were very annoyed
at the 2^31 cap on the number of streams, which caused them all sorts
of performance problems during changeovers.  2^31 streams happens well
after you need to rekey GCM.  I don't think that we can reasonably
punt on this.

My writeup was long, but I think that the fix is simple.  As much as
Nick might like to destroy TLS state (the essential parts of which
aren't a real burden, being comprised of two 32 octet secrets and an
epoch counter), I don't believe that we can just kick this particular
can down the road, tempting as it might seem.

I do want to explore the notion of binding key changes to connection
ID.  It has some nice properties.  I can't make it work without making
things more complicated than what I proposed though.