Subject: Re: [quicwg/base-drafts] Key Diversity (#2175)

From: martinduke <[email-masked]>
Date: Fri, 08 Feb 2019 20:20:03 -0800

I agree with @ekr. The key separation design is fine, but the sentence about 0-RTT doesn't make any sense. I would delete the sentence about 0-RTT, so it would read thus:

In using TLS, the central key schedule of TLS is used.  As a result of the TLS
handshake messages being integrated into the calculation of secrets, the
inclusion of the QUIC transport parameters extension ensures that keys are
not the same as those that might be produced by a server running
TLS over TCP.  To further diminish the possibility of cross-protocol key
synchronization, additional measures are provided to improve key separation.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#issuecomment-462012088

---

From: Kazuho Oku <[email-masked]>
Date: Fri, 08 Feb 2019 20:40:39 -0800

Yeah, I think we can argue that it's not just about using something other than TLS over TCP. We use the protocol name as a prefix because we believe that every protocol needs to use different keys.

I am fine with @martinduke's text, but we can be more clear about the rationale.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#issuecomment-462013042

---

From: Martin Thomson <[email-masked]>
Date: Sun, 10 Feb 2019 16:15:49 -0800

The 0-RTT text was written out of an abundance of caution.  If:

1. A server won't accept 0-RTT without successfully processing the ClientHello.
2. A QUIC server won't successfully process a ClientHello and accept if the quic_transport_parameters extension is absent.
3. A TLS over TCP server might successfully process a ClientHello and accept 0-RTT if the quic_transport_parameters extension is present.

You get into a situation where the separation we provide for keys and the change in record header format is all that prevents QUIC 0-RTT from being played out as TLS/TCP 0-RTT.  I mean, that seems like plenty, it just depends on how much spare paranoia you have.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#issuecomment-462195226

---

From: Martin Thomson <[email-masked]>
Date: Tue, 12 Feb 2019 15:37:45 -0800

Closed #2175 via #2448.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2175#event-2135267158