Subject: [quicwg/base-drafts] Where does the "quic " HKDF label apply? (#1971)

From: Martin Thomson <[email-masked]>
Date: Mon, 05 Nov 2018 22:58:49 -0800

It turns out that this isn't very clear.  Implementations and drafts don't match.

We might like to reconsider the use of a new prefix here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971

---

From: MikkelFJ <[email-masked]>
Date: Tue, 06 Nov 2018 01:42:36 -0800

Could we also get rid of the space in the label or replace it with a hyphen or something? Spaces might get lost or becomes tabs etc.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436191084

---

From: Marten Seemann <[email-masked]>
Date: Tue, 06 Nov 2018 01:46:08 -0800

I disagree that there's a problem with the space. As far as I'm aware of, it never created a problem during interop.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436192144

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 06 Nov 2018 02:06:52 -0800

@martinthomson Oh. Are you suggesting that the prefix used by the TLS key schedule needs to remain as "tls13 "?

To me, it seems that we discussed the issue at https://github.com/quicwg/base-drafts/pull/1377#pullrequestreview-124279091 but did not come to a clear conclusion.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436198579

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Nov 2018 02:11:18 -0800

Yes, I know that we discussed this.  However, the conclusion was not clear, and the resulting confusion needs to be addressed somehow.  I'm suggesting that this re-labeling isn't really needed, and has caused harm.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436199963

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Nov 2018 02:21:20 -0800

Oh, and the space thing is a done deal sadly.  We can't un-ship TLS 1.3.  We can only really control what QUIC does.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436202895

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 06 Nov 2018 02:24:15 -0800

@martinthomson I could well be missing something, but doesn't not having key separation for key schedule mean that session ticket obtained through QUIC can be reused in TLS over TCP?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436203809

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Nov 2018 02:26:25 -0800

@kazuho, as long as there is a shared secret, that can be used to resume.  It doesn't really matter how you arrived at that ticket.  The defense there is to say "don't do that", which I think we already say.  (I'll try to find a citation...)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436204465

---

From: MikkelFJ <[email-masked]>
Date: Tue, 06 Nov 2018 02:28:57 -0800

Well, I think better safe than sorry. Using a dedicated QUIC label will close any "don't do that" attack vectors.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436205257

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Nov 2018 10:33:20 +0000 (UTC)

My point here is that it won't because it can't.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436206473

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 06 Nov 2018 02:39:38 -0800

@martinthomson Clarification question: are you suggesting to drop *all* use of the "quic " prefix (to revert to "tls13 "), including key-schedule, traffic key derivation, key update, ...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436208297

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Nov 2018 18:16:33 -0800

Yes, that's the implication.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436479704

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 06 Nov 2018 18:25:08 -0800

:+1:

My understanding is that there is no prefix separation between TLS and DTLS, and therefore that we do not need that in QUIC.

It also lessens the friction we would have when moving to TLS 1.4, because the prefix can just change in the TLS stack.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436481268

---

From: Martin Thomson <[email-masked]>
Date: Tue, 06 Nov 2018 18:26:10 -0800

I hadn't considered the TLS 1.4 point, but it's a very good point.  I'll prepare a PR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#issuecomment-436481437

---

From: Martin Thomson <[email-masked]>
Date: Tue, 20 Nov 2018 14:58:20 -0800

Closed #1971 via 36c68c3f600722cd6a52f28622e60f9423ffc3f3.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1971#event-1978690498