Subject: [quicwg/base-drafts] Client MUST use 1-RTT packets if it reads 1-RTT packets (#2458)

From: Martin Thomson <[email-masked]>
Date: Tue, 12 Feb 2019 16:12:17 -0800

I am not sure if this is accurate.

IIUC their is nothing that mandates the client to switch to using 1-RTT when it receives ServerFinished. In fact, on a lossy network, a client would benefit from using 0-RTT packets until it receives an ACK for ClientFinished. In such case, it would be natural to observe these frames in a 0-RTT packet.

I think we should either forbid them or clarify that there are allowed, instead of suggesting (IMO incorrectly) that it’s impossible.

_Originally posted by @kazuho in https://github.com/_render_node/MDExOlB1bGxSZXF1ZXN0MjQ2MTcyNjUx/pull_requests/unread_timeline_

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2458

---

From: Martin Thomson <[email-masked]>
Date: Tue, 12 Feb 2019 16:19:22 -0800

To be clear, this was in reference to text that mentioned that certain frames couldn't be sent in 0-RTT.  That would only be true if we made this a requirement.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2458#issuecomment-462999723

---

From: Mike Bishop <[email-masked]>
Date: Thu, 14 Feb 2019 14:16:37 -0800

This actually is already addressed in the TLS draft, as @martinthomson pointed out in another thread:  [TLS 4.9](https://quicwg.org/base-drafts/draft-ietf-quic-tls.html#rfc.section.4.9), "Though an endpoint might retain older keys, new data MUST be sent at the highest
  currently-available encryption level."

If you have 1-RTT keys, you MUST use them.  There's currently no server verification that you do so, however.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2458#issuecomment-463823382

---

From: ianswett <[email-masked]>
Date: Thu, 14 Feb 2019 16:11:47 -0800

I think this should be stated in transport as well as TLS, along with a statement that a server MAY/SHOULD/MUST ignore 0RTT packets that have higher packet numbers than the first received 1RTT packet.  The first is editorial I believe, the latter is borderline design.

If we decided it was valid to close the connection if a 0RTT packet was received with a higher packet number than 1RTT, then that's definitely not editorial, but I think it may be a good way to enforce proper behavior.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2458#issuecomment-463854962

---

From: Kazuho Oku <[email-masked]>
Date: Fri, 15 Feb 2019 03:33:25 -0800

@ianswett 
> I think this should be stated in transport as well as TLS

Agreed.

> along with a statement that a server MAY/SHOULD/MUST ignore 0RTT packets that have higher packet numbers than the first received 1RTT packet.

I think that this should be a MAY/SHOULD close the connection with PROTOCOL_VIOLATION rather than "ignore", because that aligns the handling with how we agreed to handle other misuse of 0-RTT packets (see 
https://github.com/quicwg/base-drafts/issues/2360#issuecomment-459171200).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2458#issuecomment-464013097