Subject: [quicwg/base-drafts] TLS provides AEAD and KDF (#2046)

From: Martin Thomson <[email-masked]>
Date: Thu, 22 Nov 2018 17:28:12 -0800

Phrase this not as having TLS providing a cipher suite, but as TLS
providing functions for protection and key derivation.

It's clear that I had misinterpreted intent from others.  This cleans up the change from #2032 and makes more changes consistent with that principle throughout.  This is a companion to #2044.

Closes #2034.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2046

-- Commit Summary --

  * TLS provides AEAD and KDF

-- File Changes --

    M draft-ietf-quic-tls.md (39)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2046.patch
https://github.com/quicwg/base-drafts/pull/2046.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2046

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 22 Nov 2018 19:37:59 -0800

kazuho approved this pull request.

Looks perfect to me!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2046#pullrequestreview-177802574

---

From: janaiyengar <[email-masked]>
Date: Mon, 26 Nov 2018 19:18:09 -0800

janaiyengar approved this pull request.

> @@ -710,14 +722,19 @@ based on the client's initial Destination Connection ID, as described in
 {{initial-secrets}}.
 
 The keys used for packet protection are computed from the TLS secrets using the
-method described in Section 7.3 of {{!TLS13}}), with the labels "quic key" and
-"quic iv" in place of the labels used by TLS (that is, "key" and "iv"
-respectively).  Using these labels provides key separation between QUIC and TLS,
-see {{key-diversity}}.
+KDF provided by TLS.  In TLS 1.3, the HKDF-Expand-Label function described in
+Section 7.1 of {{!TLS13}}) is used, using the hash function from the negotiated
+cipher suite.  Other versions of TLS MUST provide a similar function in order to
+be used QUIC.
+
+ The current encryption level secret and the label "quic key" are input to the

```suggestion
The current encryption level secret and the label "quic key" are input to the
```

> @@ -753,9 +770,8 @@ thus ensuring that the keys are different for each version of QUIC. This
 prevents a middlebox that only recognizes one version of QUIC from seeing or
 modifying the contents of handshake packets from future versions.
 
-The HKDF function defined in TLS 1.3 MUST be used even in case the minimum TLS
-version that the endpoint is willing to use is greater, so as to assure that
-the peer can decrypt the packet.
+The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial

Might be worth stating "For QUICv1 ..."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2046#pullrequestreview-178595698

---

From: Martin Thomson <[email-masked]>
Date: Mon, 26 Nov 2018 19:19:54 -0800

martinthomson commented on this pull request.

Yeah, I considered that, but it's a long slide down that slope.  I think that it's sufficiently strongly implied.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2046#discussion_r236507707

---

From: Martin Thomson <[email-masked]>
Date: Mon, 26 Nov 2018 19:24:54 -0800

Merged #2046 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2046#event-1988466038