Subject: Re: [quicwg/base-drafts] Do Initial secrets change after Retry packet? (#2823)

From: Lars Eggert <[email-masked]>
Date: Tue, 02 Jul 2019 23:22:07 -0700

Are editorial clarifications needed here?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-507956642

---

From: Nick Harper <[email-masked]>
Date: Wed, 03 Jul 2019 10:49:28 -0700

At the minimum, the first sentence of the "Initial Secrets" section needs to be revised. I'd prefer to understand the design rationale for when initial keys change (and possibly incorporate that into the edit). Right now I don't understand the "why" of option 3.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-508192699

---

From: Martin Thomson <[email-masked]>
Date: Wed, 03 Jul 2019 18:37:57 -0700

I don't believe that we have any responsibility to document "why" for anything.  In this case, my understanding is that Reset is intended to be largely stateless.  If it were stateless, then the token would need to carry the original destination connection ID (or the derived key), and that would need to be extracted before the packet could be processed.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-508306625

---

From: Dmitri Tikhonov <[email-masked]>
Date: Fri, 05 Jul 2019 06:04:21 -0700

> I don't believe that we have any responsibility to document "why" for anything.

+1

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-508752190

---

From: David Schinazi <[email-masked]>
Date: Mon, 08 Jul 2019 09:56:47 -0700

Documenting "why" some choices were made is not required, but it helps readers better understand the properties of the protocol, and helps spec contributors not have the same conversations every few months.

The retry token already needs to carry the original destination connection ID because the server MUST include it in the `original_connection_id` transport parameter.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-509306831

---

From: ianswett <[email-masked]>
Date: Mon, 08 Jul 2019 14:11:54 -0700

This is marked as editorial, but 3 seems like the most non-obvious design choice, and it's not clear we intended to make that choice.

If extracting the original CID is potentially too difficult for some, why not 2, which only uses local state to process Initial packets?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-509393487

---

From: ianswett <[email-masked]>
Date: Mon, 08 Jul 2019 18:37:20 -0700

Of note, in section 2.6 of the new draft from @kazuho and @huitema on protection Initials it says:
"The Destination Connection ID of the Initial packet MUST be set to the value specified by the Retry packet, however the keys for encrypting and authenticating the packet MUST continue to be the original ones."

This aligns with the first option.  It seems like the first option also allows us to remove a transport param, which is a nice property.

Given that, is anyone actively opposed to the first option assuming someone else(ie: myself or Nick) writes a PR?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2823#issuecomment-509452429