Re: [TLS] Comments on EndOfEarlyData

Eric Rescorla <> Tue, 16 May 2017 21:33 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1F22912EA58 for <>; Tue, 16 May 2017 14:33:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.598
X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 9XXniEgtn7L7 for <>; Tue, 16 May 2017 14:33:54 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4002:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 8D37D124D6C for <>; Tue, 16 May 2017 14:28:56 -0700 (PDT)
Received: by with SMTP id l14so59526471ywk.1 for <>; Tue, 16 May 2017 14:28:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=+bH4105EZ+kYadsxUTzOId+NnvjABJXvuzFwXQpO5Qk=; b=A6BBCfy6znLmeKYP3xDMy0tF2AZ5X10qI8orjb043G9dMiH4ct/L/etbCNXG15kDTd HmSig1VqL6OcOLiiNvL9RSQJzj8YQ0PL9AH1Gm45MIHfGteIb+m8tHzTtNnvmzxAU/jj WiEJBgz1NFWwusHmKvzjR8tVNvFmJruAuNJb4ZvKHps3eU5uVFw0u20bKdA5zGkEfGF6 Ss8mHpAKJJKgsS0tNaNpmh5qlzJbS1xJ9fmIrzfbJMqe6tZSQas//waStlzQOG6dzW7Q k40Agl5aDIVMc2qJInaG1cG89ONwO4vEjpBU/00s3ObD1XuWvKg7LCGV+xhjUrvBrYPV O/YQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=+bH4105EZ+kYadsxUTzOId+NnvjABJXvuzFwXQpO5Qk=; b=Ocs6G38U5xOAEwuZ4Sa+Xwr4lQEUe9ITvMUlEmuITAQyYffS2jolXgf4L2WrGxVgVR uNgQrdrM8NBLxv3b+5TvaEZOQc+3Z7adT4XpC6S3CXw3Xs1+JNHSE+etegHLAZMUnpcd RriXUzce02Xp5FLS9fqf9GAzKq37y+FybiPQ/U0DXyOIj2RqaBeM13efAAAXuVuNT+Ls YNkiiXsm8W7u0ZWlp+tKzHD9lnR9cRu16r1dPkoyw76k6/jGv6OBcZZVjYDsHJngMURm L17pTyKSCnY5FW0p03qKJLscfAthl35w4VayZ/BWKCyDmW/7MQUQ26+8xDUN37Vo8MHB wTvg==
X-Gm-Message-State: AODbwcDZuE7fudlkib/5pa+jgcU10+0mJKkBhx6sxqTmT8B9XvCQ0dhn zf/FoETuL/o/Nwj8gE4Cca9AUfAmp1s8Eos=
X-Received: by with SMTP id w1mr59731ywd.24.1494970135841; Tue, 16 May 2017 14:28:55 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Tue, 16 May 2017 14:28:15 -0700 (PDT)
In-Reply-To: <>
References: <> <> <>
From: Eric Rescorla <>
Date: Tue, 16 May 2017 14:28:15 -0700
Message-ID: <>
To: Britta Hale <>
Cc: "" <>
Content-Type: multipart/alternative; boundary="001a114fb0f6e5a448054faadb35"
Archived-At: <>
Subject: Re: [TLS] Comments on EndOfEarlyData
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 16 May 2017 21:33:56 -0000

On Tue, May 16, 2017 at 2:10 PM, Britta Hale <> wrote:

> On 16. mai 2017 20:59, Eric Rescorla wrote:
> However, this intuition is incorrect. Alerts signal the end-of-use of
> keys, not the prohibition of further communication under other keys.
> Keys should be deleted and no further data should be sent on the
> connection.
> This last sentence seems to reinforce the motivating intuition here,
> namely that the alert signals the end of the *connection*, and so it's
> odd to have EOED indicate a key change within a connection.
> Avoiding getting caught on the word "connection", EOED signals the end of key
> use like other alerts, which is the central issue. Notably, EOED does
> not signal key change, unlike a KeyUpdate message or Finished message - even
> the name indicates that it is for "end of data". Its behavior is fundamentally
> like an alert's, indicating only end-of-key use for application data.
I'm not sure why you say it doesn't signal a key change: EOED signals the
between data encrypted with the early traffic keys and that encrypted with
the handshake

> Specifically, the 0-RTT handshake is
> followed by 0-RTT data and finally an EndOfEarlyData alert to end use of
> that key, while in parallel the remainder of the handshake and
> subsequent session key act almost as a further resumption (i.e. under a
> different key).
> I can see how you could look at it this way, but I'm not sure that that's
> the natural way to look at it. If you're not doing DH, then these are
> very much derived from the same PSK and the same client-side
> nonce.
> In that case, they are both then related to the master key of the previous
> session, which may well have ended with a close_notify, i.e. a properly
> finished key use signaled by an alert.
> Yes, that's true, but I'm not sure I see the relevance of this point.