Re: Consensus Calls for Transport/TLS issues, post-Cupertino

[Christian Huitema <[e-mail]>]

On 10/30/2019 6:44 PM, Martin Thomson wrote:

> On Thu, Oct 31, 2019, at 12:32, Christian Huitema wrote:
>> Migration is only initiated by the client in V1, so waiting for the last
>> handshake ACK on the client side is good enough. But key rotation could
>> be initiated by the server, and doing that before handshake confirmed is
>> a bit problematic. 
> I don't see how this is problematic.  Handshake packets use Handshake keys, so they aren't updated.

Yes, that should work. The client could also consider the
server-initiated key rotation as an implicit acknowledgement of the
Handshake packets, since the server is only supposed to initiate a
rotation after Handshake Confirmed. The client can delete the Handshake
Key at that point.

In fact, If the server successfully sees the client rotating the keys,
it can induce that the client has received an implicit ack of all the
handshake packets, and it too can delete its Handshake Keys. So if
either side initiates a key rotation and the key rotation succeeds, both
sides can jettison the Handshake keys -- provided the server only
initiates after receiving the Client Finished message, and the client
only initiates after receiving an ACK of that message.

So we have a solution that works if the server if willing to keep the
Handshake key forever, and allows the server to jettison the Handshake
keys if it is willing to rotate the 1RTT key.

-- Christian Huitema