Re: [TLS] Data volume limits

Ilari Liusvaara <> Fri, 01 January 2016 14:40 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 29B681ACD1C for <>; Fri, 1 Jan 2016 06:40:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 1.09
X-Spam-Level: *
X-Spam-Status: No, score=1.09 tagged_above=-999 required=5 tests=[BAYES_50=0.8, MIME_8BIT_HEADER=0.3, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id GyJJ37QYPnRU for <>; Fri, 1 Jan 2016 06:40:21 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id E71581ACD19 for <>; Fri, 1 Jan 2016 06:40:20 -0800 (PST)
Received: from localhost (localhost []) by (Postfix) with ESMTP id EE6CD1FC; Fri, 1 Jan 2016 16:40:18 +0200 (EET)
X-Virus-Scanned: Debian amavisd-new at
Received: from ([IPv6:::ffff:]) by localhost ( [::ffff:]) (amavisd-new, port 10024) with ESMTP id EO_GbvYCBpij; Fri, 1 Jan 2016 16:40:18 +0200 (EET)
Received: from LK-Perkele-V2 ( []) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 7530E27B; Fri, 1 Jan 2016 16:40:18 +0200 (EET)
Date: Fri, 1 Jan 2016 16:40:16 +0200
From: Ilari Liusvaara <>
To: Henrick Wibell =?utf-8?Q?Hellstr=C3=B6m?= <>
Message-ID: <>
References: <r422Ps-10112i-A7598D6B042F444AA21AABEA3552ADF5@Williams-MacBook-Pro.local> <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <>
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: <>
Subject: Re: [TLS] Data volume limits
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 01 Jan 2016 14:40:23 -0000

On Fri, Jan 01, 2016 at 01:54:00PM +0100, Henrick Wibell Hellström wrote:
> I think it is a good idea to rekey AES-GCM after approximately 2^32 records,
> give or take a few magnitudes.
> The question for me isn't whether AES-GCM requires frequent rekeying (it
> does), but exactly how much complexity the rekeying mechanism would add, to
> the protocol and to implementations.

There have been three basic proposed categories of key update schemes:

1) Ratchet keys through KDF, no new randomness.
2) Ratchet keys through KDF, with new randomness
3) Do new PK key exchange

Also, if one doesn't want applications to have to be aware of rekeying,
one can't introduce new flights ("fully asynchronous key update"). This
would cause _severe_ constraints.

Then there is strictly weaker constraint that one can't introduce "dead
air", where the protocol can't make forward progress without waiting
for response (the previous constraint is sufficient but not necressary
to meet this).

Firstly, 1)

The current scheme is example of 1) without new flights. Basically,
send a message to ratchet sender's keys. There is no symmetry-breaking
between updates, so if k(i) = k(j), then k(i+n) = k(j + n) (such
symmetry-breaking could be introduced by adding key number to KDF

Also, I noted that the current scheme seems to break HKDF pairing:
It tries to expand already expanded value (traffic secret). This
violates pairing.

Also, scheme like this could nicely work with DTLS: One could use
epoch numbers to signal rekeying (but one would then take care
not wrap epoch in way that could cause confusion).

Then 2)

Doing 2) without new flights would imply:

- Two traffic keys, one for each direction. The low-level ciper keys
  derive from traffic key of respective direction.
- Sending message to update keys would update only the traffic key
  in sending direction, regenerating low-level cipher keys and resetting
  the RSN in that direction.
- Entropy from peer can't be explicitly be used. The best one could
  do here is to recommend mixing last received ratchet entropy from
  peer into own entropy to produce the random value to send when
  replying (when that happens).

I don't think this is terribly more complicated than 1). But it is
more complicated nevertheless.

I don't see dropping the stronger full asynchronous constraint would
simplify things, due to possibility of "crossed rekey" caused by
finite "speed of light".

Also, this would cause issues with DTLS: One would have to reliably
transmit these rekeying messages, whereas previous DTLS are reliable
only within handshake.

Finally 3)

Now the rekeying necressarily involves two messages. Doing this
fully asynchronously seems just about impossible (updating one half-
key at a time would hit "key caching" problem).

Then it would be whole new logic for performing PK exchange. One
can't reuse handshake because it would introduce thorny issues about
tying to previous handshake and ensuring that state doesn't change
in all sorts of unexpected ways. It also would need to somehow
prevent crossing a key update.

All in all, the complexity looks grealy greater than 1) or 2).