Re: Consensus Calls for Transport/TLS issues, post-Cupertino

[Eric Rescorla <[e-mail]>]

On Wed, Oct 30, 2019 at 2:33 PM Mikkel Fahnøe Jørgensen <[e-mail]>
wrote:

> If the goal is to decide when the handshake is complete at both ends in
>> finite time with high probability, then it appears that an explicit signal
>> is required because you cannot rely on random (organic) 1-RTT traffic to
>> drive this process.
>>
> Well, it's not clear to me that one needs to know this, actually. I agree
> we've used this as a proxy for various things, but it's not actually clear
> to me that we need to, so we should re-examine those cases to see what the
> real preconditions are.
>
> For one thing, I would be sad if an optimised implementation needs to
> handle multiple packet number spaces. That complicates implementations
> because you need to think performance through all layers. Of course you can
> just suck it up an deal with it. Likewise, you can probably find a way
> around path migration.
>
> By compared to sending a single 1-byte HANDSHAKE_DONE frame, why would you
> do that? To marginally simplify the handshake?
>
This isn't an argument that keeping the keys around doesn't work, but
rather that you think it's the wrong engineering tradeoff. It's possible
you're right about that, but I'd like to start by establishing the agreed
upon facts of what will and will not work before we debate engineering
tradeoffs.

-Ekr