Subject: [quicwg/base-drafts] Forbid TLS-level KeyUpdate in draft-ietf-quic-tls (#1833)

From: David Benjamin <[email-masked]>
Date: Thu, 04 Oct 2018 14:54:23 -0700

Since QUIC uses its own mechanism, the spec should say the TLS-level KeyUpdate MUST NOT be sent and MUST be treated as a fatal error on receive.

Otherwise an implementation may forget about this and, when TLS sees a KeyUpdate, call some callback in some weird unexpected way and confuse things.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1833

---

From: MikkelFJ <[email-masked]>
Date: Thu, 04 Oct 2018 15:12:07 -0700

There must be some form of key update otherwise GCM is not safe on long running connections.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1833#issuecomment-427186399

---

From: Mike Bishop <[email-masked]>
Date: Thu, 04 Oct 2018 15:40:59 -0700

There is.  TLS, section 6.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1833#issuecomment-427192506

---

From: David Benjamin <[email-masked]>
Date: Thu, 04 Oct 2018 16:21:47 -0700

Right. Thus "[s]ince QUIC uses its own mechanism". :-)

Either way, the KeyUpdate message should be discussed in that text somewhere. If QUIC replaces it with its own mechanism, the spec text should forbid it. If QUIC makes TLS-level KeyUpdate somehow meaningful, it's got to actually specify what it does. QUIC handles record encryption and isn't ordered like TCP. The existing TLS KeyUpdate behavior doesn't apply.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1833#issuecomment-427200022

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:43:35 -0700

Closed #1833 via e5eee0baa74b8ee840eb66d3fe2dd3cfe25b39f3.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1833#event-1922017048