Subject: [quicwg/base-drafts] The "quic " label is used for key update (#1899)

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:12:30 -0700

Closes #1845.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1899

-- Commit Summary --

  * The "quic " label is used for key update

-- File Changes --

    M draft-ietf-quic-tls.md (25)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1899.patch
https://github.com/quicwg/base-drafts/pull/1899.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:13:38 -0700

@martinthomson pushed 1 commit.

6489433  Use 'it' less

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899/files/7ad0b15419b216453fc67fc2749aabdeeeff097c..6489433b169879e9c573aa8d680e4e99e9e3b897

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:25:54 -0700

e5eee0b  Use unexpected_message for KeyUpdate

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899/files/6489433b169879e9c573aa8d680e4e99e9e3b897..e5eee0baa74b8ee840eb66d3fe2dd3cfe25b39f3

---

From: janaiyengar <[email-masked]>
Date: Tue, 23 Oct 2018 16:39:12 -0700

janaiyengar commented on this pull request.

> @@ -983,23 +983,31 @@ without necessarily needing to receive the first packet that triggered the
 change.  An endpoint that notices a changed KEY_PHASE bit can update keys and
 decrypt the packet that contains the changed bit.
 
+This mechanism replaces the TLS KeyUpdate message.  Endpoints MUST NOT send a
+TLS KeyUpdate message.  Endpoints MUST treat the receipt of a TLS KeyUpdate
+message as a connection error of type 0x10a, equivalent to a fatal TLS alert of
+unexpected_message (see {{tls-errors}}).
+
 An endpoint MUST NOT initiate more than one key update at a time.  A new key
 cannot be used until the endpoint has received and successfully decrypted a
 packet with a matching KEY_PHASE.
 
 A receiving endpoint detects an update when the KEY_PHASE bit doesn't match what

```suggestion
A receiving endpoint detects an update when the KEY_PHASE bit does not match what
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899#pullrequestreview-167681004

---

From: janaiyengar <[email-masked]>
Date: Tue, 23 Oct 2018 23:40:13 +0000 (UTC)

A receiving endpoint detects an update when the KEY_PHASE bit doesn't match what
 it is expecting.  It creates a new secret (see Section 7.2 of {{!TLS13}}) and
-the corresponding read key and IV.  If the packet can be decrypted and
-authenticated using these values, then the keys it uses for packet protection
-are also updated.  The next packet sent by the endpoint will then use the new
-keys.
-
-An endpoint doesn't need to send packets immediately when it detects that its
-peer has updated keys.  The next packet that it sends will simply use the new
-keys.  If an endpoint detects a second update before it has sent any packets
-with updated keys it indicates that its peer has updated keys twice without
-awaiting a reciprocal update.  An endpoint MUST treat consecutive key updates as
-a fatal error and abort the connection.
+the corresponding read key and IV.  This uses the same variation on HKDF as

```suggestion
the corresponding read key and IV using the same variation on HKDF as
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899#pullrequestreview-167681218

---

From: janaiyengar <[email-masked]>
Date: Tue, 23 Oct 2018 16:41:15 -0700

-An endpoint doesn't need to send packets immediately when it detects that its
-peer has updated keys.  The next packet that it sends will simply use the new
-keys.  If an endpoint detects a second update before it has sent any packets
-with updated keys it indicates that its peer has updated keys twice without
-awaiting a reciprocal update.  An endpoint MUST treat consecutive key updates as
-a fatal error and abort the connection.
+the corresponding read key and IV.  This uses the same variation on HKDF as
+defined in {{protection-keys}}; that is, the prefix "quic " is used in place of
+"tls13 ".
+
+If the packet can be decrypted and authenticated using the updated key and IV,
+then the keys the endpoint uses for packet protection are also updated.  The
+next packet sent by the endpoint will then use the new keys.
+
+An endpoint doesn't always need to send packets when it detects that its peer

```suggestion
An endpoint does not always need to send packets when it detects that its peer
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899#pullrequestreview-167681460

---

From: janaiyengar <[email-masked]>
Date: Tue, 23 Oct 2018 16:41:53 -0700

-with updated keys it indicates that its peer has updated keys twice without
-awaiting a reciprocal update.  An endpoint MUST treat consecutive key updates as
-a fatal error and abort the connection.
+the corresponding read key and IV.  This uses the same variation on HKDF as
+defined in {{protection-keys}}; that is, the prefix "quic " is used in place of
+"tls13 ".
+
+If the packet can be decrypted and authenticated using the updated key and IV,
+then the keys the endpoint uses for packet protection are also updated.  The
+next packet sent by the endpoint will then use the new keys.
+
+An endpoint doesn't always need to send packets when it detects that its peer
+has updated keys.  The next packet that it sends will simply use the new keys.
+If an endpoint detects a second update before it has sent any packets with
+updated keys it indicates that its peer has updated keys twice without awaiting

```suggestion
updated keys, it indicates that its peer has updated keys twice without awaiting
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899#pullrequestreview-167681585

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:42:13 -0700

76b70fd  does not

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899/files/e5eee0baa74b8ee840eb66d3fe2dd3cfe25b39f3..76b70fd0135e025833d30e700affd2096b6a1416

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:42:49 -0700

24ac0f0  glom together

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899/files/76b70fd0135e025833d30e700affd2096b6a1416..24ac0f076890955eec6d1f7edef859dbed28460d

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:43:07 -0700

fa1d40c  does not

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899/files/24ac0f076890955eec6d1f7edef859dbed28460d..fa1d40cbb9333fa163821630ac6b120338a434ee

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:43:12 -0700

a5c5af3  comma

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899/files/fa1d40cbb9333fa163821630ac6b120338a434ee..a5c5af3e59cb75aa37719c0d6632adfd3f618c35

---

From: Martin Thomson <[email-masked]>
Date: Tue, 23 Oct 2018 16:43:33 -0700

Merged #1899 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1899#event-1922016996