Subject: [quicwg/base-drafts] client's Handshake write key needs to be exported early (#2328)

From: Marten Seemann <[email-masked]>
Date: Wed, 09 Jan 2019 18:47:00 -0800

In order for the client to be able to acknowledge packets sent with Handshake encryption level, it needs to have access to the Handshake write key right after processing the ServerHello.

https://tools.ietf.org/html/rfc8446#appendix-A.1 states that the Handshake write key is exported after receiving the server's Finished message, which would make loss recovery of Handshake packets impossible.

I found this fact non-obvious, and I think it should be documented in some way that we're deviating from the schedule in which a normal TLS 1.3 implementation would make new keys available.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2328

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Jan 2019 19:45:03 -0800

I had the same realization a while ago, but failed to capture that in the spec.  It's a fairly important point that - if ignored - would lead to bad outcomes, because a good part of the time you can get away with not exporting it early.  You mostly just get transient errors... until the server can't fit its certificate into 3 packets, then you get a hard fail.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2328#issuecomment-452960769