Subject: Key Life

From: Mikkel Fahnøe Jørgensen <[email-masked]>
Date: Wed, 15 Aug 2018 01:20:11 -0400

https://github.com/quicwg/base-drafts/pull/1636

"Once this timer expires, an endpoint MUST NOT either accept or generate
new  packets using those packet protection keys.  An endpoint can discard
packet  protection keys for that encryption level.”

I don’t understand this. If an older crypto stream was important before
timeout, why isn’t it important after timeout?
If the peer is missing some packet, I would presume that it cannot proceed
with the handshake and a deadlock would occur?

I can see that packets can dropped later on, during key update.

Why not have an explicit signal to indicate the end of life of a crypto
stream and use that to discard keys?
I can see that an explicit signal won’t be ideal post handshake because a
peer can then force old keys forever, but during handshake that would seem
reasonable to me.

This probably ties in with the discussion of client finished signalling.

Kind Regards,
Mikkel Fahnøe Jørgensen

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 15 Aug 2018 14:37:46 +0900

2018年8月15日(水) 14:20 Mikkel Fahnøe Jørgensen <[email-masked]>:
> "Once this timer expires, an endpoint MUST NOT either accept or generate new  packets using those packet protection keys.  An endpoint can discard packet  protection keys for that encryption level.”
>
> I don’t understand this. If an older crypto stream was important before timeout, why isn’t it important after timeout?
> If the peer is missing some packet, I would presume that it cannot proceed with the handshake and a deadlock would occur?

No. Because if the peer is still transmitting data, it will retransmit
that before the timer expires.

> Why not have an explicit signal to indicate the end of life of a crypto stream and use that to discard keys?
> I can see that an explicit signal won’t be ideal post handshake because a peer can then force old keys forever, but during handshake that would seem reasonable to me.

That was discussed at the Interim in June and also at IETF 102.

IIUC, some if not most of us are comfortable with using timers.

Others who want an explicit signal can rely on that. An endpoint can
deduct such signal from the receipt of packets at a higher encryption
level. For the tail, the client can send a PING frame and use the
receipt of ACK against the PING as a signal that the server has
received all handshake packets.

To summarize, current draft provides the freedom to implement either ways.

-- 
Kazuho Oku