Subject: [quicwg/base-drafts] Clarify and strengthen key update requirements (#1457)

From: MikkelFJ <[email-masked]>
Date: Mon, 18 Jun 2018 12:44:47 +0000 (UTC)

>From several discussions it appears that the importance of key updates are not well understand and the consequences can be fatal. The requirement are in place via numerous indirect links over TLS 1.3 spec and further documents.

Some crypto modes can handle a large number of pakcets safely while others break down statistically, including AES-GCM.

A solution could be to require key updates no later than after 2^32 packets and require a protocol error shutdown if peer does not rekey in time. While 2^32 may be early in some cases, it is not realy burden, and the alternative might be that implementations skip handling key updates.

See also discussion here:
https://github.com/quicwg/base-drafts/issues/1405#issuecomment-398022746

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1457

---

From: Martin Thomson <[email-masked]>
Date: Mon, 18 Jun 2018 22:27:20 -0700

The current design has limits for each cipher suite, that would be inherited from TLS.  If we want to reference those requirements, we can do so.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1457#issuecomment-398278424