Subject: [quicwg/base-drafts] Key Diversity (#2175)

From: ekr <[email-masked]>
Date: Thu, 13 Dec 2018 16:26:23 -0800

This doesn't look right

```
In using TLS, the central key schedule of TLS is used.  As a result of the TLS
handshake messages being integrated into the calculation of secrets, the
inclusion of the QUIC transport parameters extension ensures that handshake and
1-RTT keys are not the same as those that might be produced by a server running
TLS over TCP.  However, 0-RTT keys only include the ClientHello message and
might therefore use the same secrets.  To avoid the possibility of
cross-protocol key synchronization, additional measures are provided to improve
key separation.
```

The CH will also contain the QUIC transport parameters, so why aren't those keys different

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175

---

From: Martin Thomson <[email-masked]>
Date: Thu, 13 Dec 2018 16:57:56 -0800

Yes, but a TLS/TCP server will ignore those, so it's the transport parameters in EncryptedExtensions that ensure diversity.

This is defense is depth, as it says.  What do you think we should say instead?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#issuecomment-447175904

---

From: ekr <[email-masked]>
Date: Thu, 13 Dec 2018 17:02:38 -0800

I'm not sure, because I'm not really sure what this is trying to say. Concretely, the concern seems to be that it would be possible to somehow transplant 0-RTT QUIC data onto a TLS-over-TCP connection or vice versa? However, I don't believe this is actually possible even if the same keys are used because QUIC long header packets are incompatible cryptographically with TLS records.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#issuecomment-447176704

---

From: Martin Thomson <[email-masked]>
Date: Thu, 13 Dec 2018 17:37:50 -0800

Yes, the transplanting is prevented by many things.  The extension, the fact that the formats are incompatible, and key diversity.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#issuecomment-447183127