Re: [TLS] KeyUpdate and unbounded write obligations

Eric Rescorla <> Sun, 28 August 2016 18:51 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6572912B054 for <>; Sun, 28 Aug 2016 11:51:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id TT1zItl82LKx for <>; Sun, 28 Aug 2016 11:51:09 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 1ABEE12B032 for <>; Sun, 28 Aug 2016 11:51:09 -0700 (PDT)
Received: by with SMTP id u134so75323410ywg.3 for <>; Sun, 28 Aug 2016 11:51:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=+2yGIKrjNSJl5N2qLncCYqwHDejTvcBtds/BTezLkOE=; b=I6yu24lyaGkrRSnJQK4SRuXT/vFxppXgpXBN/ZTsP9LzlMTz9RqrjYtRNIAUsVtOUJ +2hJGlMfRDIvJ5rPGbrrF7xKSengVegE+UXAzWRGc/3MtK9vuO1Bnpq6SOf6nQVq4Jh/ KdVmYEHB17zsfZgksE7arRkGrIy663KW301Rv0v1t9r+rfzGaMjvVQ3a0oCvsY9w5Qq9 q6lew1KwqyDm3LRrFRTfKjMf+uUbk/N0EM/wzvDuRl0GBfrAtlxyQc2q24HFs3AKzS/I 0XUyVSrhuHMNRTurNaRqXeR95ZGzWRJGSLyDpfIeXtU6xMxN+inDZ3+zeYVZpc+WBUWg snNw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=+2yGIKrjNSJl5N2qLncCYqwHDejTvcBtds/BTezLkOE=; b=kCHyNBIFMyuvlR3gYu7b6lElQocQMqcFDZqqQY0Kaq7GMnRBZPoGaO6eJazCKB0LOO m4omrCZk9ZTBmedZiELBmZTMcfK8bfI1S+GxKLFpO89FmM3aOkDfKyRIHX+YpBj7mRWV Wns6HxucngH2t8oioiPrd6hWzW4Hw8NbrfmqKZKZpjheWspug4rUd5voVgCOEOlfy7G+ dI6XptYojrzOj70hRYPDHTQNtRs0Foe4mvDAYuc2g8AG99m145A03sVPpZPyhZ+TpxW1 0UfrC8+rtYAVkfI3xA3VUp12rFFOma/GowfZ4rA+GTgwPKZkm1JrZqxT7crjMaytFbSk /AbA==
X-Gm-Message-State: AE9vXwOA/SYS0bun/4iL9vckHhvmHN3th9McBuHoVduqA0XR3VBLL6tTz506QcY6X407MlspvyQLJlVmTq3cJw==
X-Received: by with SMTP id f1mr12231352ywe.289.1472410268399; Sun, 28 Aug 2016 11:51:08 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Sun, 28 Aug 2016 11:50:27 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <> <> <>
From: Eric Rescorla <>
Date: Sun, 28 Aug 2016 11:50:27 -0700
Message-ID: <>
To: Ilari Liusvaara <>
Content-Type: multipart/alternative; boundary="94eb2c0809f0032c78053b263bb2"
Archived-At: <>
Cc: "" <>
Subject: Re: [TLS] KeyUpdate and unbounded write obligations
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 28 Aug 2016 18:51:10 -0000

On Sun, Aug 28, 2016 at 11:41 AM, Ilari Liusvaara <>

> On Sun, Aug 28, 2016 at 10:53:14AM -0700, Eric Rescorla wrote:
> >
> > I'd prefer to keep things as simple as possible here and from that
> > perspective, I think any indicator from side A to side B that it wants a
> > key change over and above the KeyUpdate is extra complexity. I do,
> however,
> > want to retain the property that one side can ask the other one to rekey
> > [0]. I believe we can get this by modifying the rule in the spec by
> treating
> > a run of KeyUpdates as a single generation.
> >
> > Specifically.
> > "Upon receiving a KeyUpdate, the receiver MUST update its receiving
> > keys. If the receiver has sent any data records since receiving the
> > last KeyUpdate it MUST also increment its min_send_generation counter
> > by 1. Otherwise, the min_send_generation MUST remain unchanged. Prior
> > to sending a record, if min_send_generation is greater than the
> > current sending generation, the sender MUST first send a KeyUpdate."
> Timing- and propagation-wise, it looks workable (also, could be done
> with two flags[1], no need for counter).
> Yes, this causes lots more desync between sides, but existing
> mechanism needed to cope with that already.
> However, one problem: Because both sides take their keys from one
> ladder, if one side is behind the other, one can extract past keys
> of other side from the one that is behind (running separate ladders
> in both directions[2][3] would fix this).

Yes, I agree separate ladders would fix this. I don't necessarily object to
change, but I'm not sure it's that big a deal either, because you really
only get
into this case when there's a big asymmetry in sending rate, so much that
one side wants to send multiple updates before the other side has sent
any data at all.

Note: it's also possible to avoid the rollback problem with the existing
single-ladder system: when you send a key update you compute:


You then discard traffic_secret N, write_key_N, but key read_key_N, so if
are M updates ahead of the other side, you have M read keys outstanding,
but these cannot be used to produce the write keys. However, this probably
isn't simpler than just running two ladders if we think this is important.