Subject: Sending/Receiving packets before client Finished

From: Eric Rescorla <[email-masked]>
Date: Thu, 13 Apr 2017 13:19:02 -0700

Rereading the -tls draft, it's not entirely clear to me what the
rules are around the client's Finished. I think the rules you
are applying (on the server, because the client has no such issues):

- The server can process 0-RTT messages immediately (S 8.2)
- The server can process 1-RTT messages upon receiving either
  the client's Finished or the PSK binder (S 8.3) [0]
- The server can send messages with the 1-RTT keys upon sending
  Finished, either in 0.5 RTT or in 1-RTT. (implied in S 4.2.3)

Do I understand this correctly? If so, I may have some proposed
changes, but I'd like to understand the intention first.

Thanks,
-Ekr

[0] Though it's actually sort of confusing because the second
graf permits the Finished or the PSK binder and the last graf
says you can't use packets before Finished if you depend on
client auth.

---

From: Martin Thomson <[email-masked]>
Date: Wed, 19 Apr 2017 09:48:18 +1000

That sounds right.  The change to allow receipt after validating the
PSK binder is new, so there are almost certainly some editing errors.

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 19 Apr 2017 07:32:20 -0400

OK. If so, I think we should probably do something about the HOL blocking
on FInished. This draft proposes one approach, which is send Finished a lot.
I am aware of at least two others:

1. Add a length field to the long header and stuff Finished and app data in
the same UDP datagram (probably my preferred approach)
2. Do what TLS does not do (though DTLS will have to confront) and allow
application data to be received prior to Finished (the analysis in OPTLS
suggests that if you are willing to sacrifice key confirmation this is
okish, but would need a lot more thought).

-Ekr

---

From: Martin Thomson <[email-masked]>
Date: Thu, 20 Apr 2017 10:25:16 +1000

> the same UDP datagram (probably my preferred approach)

Yeah, you still need to send Finished lots for this to work.  It's
rare that the flight of application data with Finished is just one
packet (and if it is, the HOL blocking isn't that interesting).

> okish, but would need a lot more thought).

Yep, absent client authentication, that *might* be ok.  Though, I
confess to not understanding all of the implications of that choice
and would want more confidence.  Thinking really hard sounds like it
could be unpleasant, but if someone else can do that thinking for me,
that would be grand.

I've opened an issue on this: https://github.com/quicwg/base-drafts/issues/446