Subject: [quicwg/base-drafts] always use "tls13 " prefix for Initial packets (#2032)

From: Kazuho Oku <[email-masked]>
Date: Tue, 20 Nov 2018 21:21:01 -0800

With #1991 being merged, we now always use the HKDF function defined in TLS 1.3. We also allow the endpoints to use a TLS version greater than that (see [section 4.2](https://quicwg.org/base-drafts/draft-ietf-quic-tls.html#rfc.section.4.2)).

Now the corner case is what is the prefix of the HKDF function is to be used for a Initial packet, when the client's minimum TLS version is 1.4.

I think it's worth clarifying that it is "tls13 " even in the case, because otherwise the peer cannot decrypt the packet.

Hence the PR.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2032

-- Commit Summary --

  * always use "tls13 " prefix for Initial packets

-- File Changes --

    M draft-ietf-quic-tls.md (4)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2032.patch
https://github.com/quicwg/base-drafts/pull/2032.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032

---

From: Marten Seemann <[email-masked]>
Date: Tue, 20 Nov 2018 21:26:46 -0800

marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#pullrequestreview-177081192

---

From: Martin Thomson <[email-masked]>
Date: Tue, 20 Nov 2018 22:32:35 -0800

Merged #2032 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#event-1979215959

---

From: Martin Thomson <[email-masked]>
Date: Tue, 20 Nov 2018 22:32:39 -0800

Very nice, thanks!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#issuecomment-440552469

---

From: MikkelFJ <[email-masked]>
Date: Wed, 21 Nov 2018 10:43:27 +0000 (UTC)

Good catch!

But I think it could be dangerous to dictate security parameters for future versions. For example HKDF might be broken e.g. through advances in GPU chips or possible quantum crypto? Maybe this is not important for the initial secret but at least the implications should be understood.

Alternatively the text could be extended by saying that HKDF 1.3 is used in future versions that wish to be able to interop with this version.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#issuecomment-440618511

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 21 Nov 2018 02:48:32 -0800

@mikkelfj The text introduced in this PR deals specifically about the encryption context of Initial packets which is actually an obfuscation, therefore I do not think we have a risk here.

What #2034 proposes is using "tls13 " for other types of packets, and for that I agree that we have the security concern (though in such case we do have the option to update QUIC itself).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#issuecomment-440620067

---

From: janaiyengar <[email-masked]>
Date: Wed, 21 Nov 2018 15:39:41 -0800

janaiyengar commented on this pull request.

> @@ -753,6 +753,10 @@ thus ensuring that the keys are different for each version of QUIC. This
 prevents a middlebox that only recognizes one version of QUIC from seeing or
 modifying the contents of handshake packets from future versions.
 
+The HKDF function defined in TLS 1.3 MUST be used even in case the minimum TLS
+version that the endpoint is willing to use is greater, so as to assure that
+the peer can decrypt the packet.

s/the packet/the Initial packet

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#pullrequestreview-177463199

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 22 Nov 2018 00:25:39 +0000 (UTC)

kazuho commented on this pull request.

Nice catch. We should update the text depending on the conclusion of #2034.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2032#discussion_r235572915