Subject: [quicwg/base-drafts] RETIRE_KEYS proposal (#2492)

From: David Schinazi <[email-masked]>
Date: Thu, 28 Feb 2019 16:28:50 -0800

We had discussed RETIRE_KEYS in Tokyo, and this PR attempts to write that up.

RETIRE_KEYS is an explicit signal allowing peers to agree on when to discard unused keys. It simplifies the text for discarding initial keys and allows efficiently discarding handshake keys without requiring timers or risking deadlocks (#2214).

I believe this is simpler to reason about than the KEYS_ACTIVE proposal (#2237) and safer as it makes less assumptions about the handshake protocol.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2492

-- Commit Summary --

  * Initial draft of RETIRE_KEYS

-- File Changes --

    M draft-ietf-quic-tls.md (48)
    M draft-ietf-quic-transport.md (46)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2492.patch
https://github.com/quicwg/base-drafts/pull/2492.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2492

---

From: Martin Thomson <[email-masked]>
Date: Thu, 28 Feb 2019 19:37:52 -0800

martinthomson commented on this pull request.

>  Though an endpoint might retain older keys, new data MUST be sent at the highest
 currently-available encryption level.  Only ACK frames and retransmissions of
 data in CRYPTO frames are sent at a previous encryption level.  These packets
 MAY also include PADDING frames.
 
-Once this timer expires, an endpoint MUST NOT either accept or generate new
-packets using those packet protection keys.  An endpoint can discard packet
-protection keys for that encryption level.
+Endpoints coordinate on when to discard unused keys using the RETIRE_KEYS
+frame. At a high level, each endpoint sends a RETIRE_KEYS frame when they
+are done sending using those keys; when an endpoint has both sent and received
+a RETIRE_KEYS frame for a given encryption level, it discards the corresponding
+keys. More specifically, an endpoint is done sending using a given set of keys

This is probably not what you intended here.  I think you mean to say that all *previous* keys are discarded.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2492#pullrequestreview-209416350