Subject: [quicwg/base-drafts] Initial secrets change after Retry (#2870)

From: Martin Thomson <[email-masked]>
Date: Tue, 02 Jul 2019 23:35:23 -0700

This was implied, but not explicit previously.

Closes #2823.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2870

-- Commit Summary --

  * Initial secrets change after Retry

-- File Changes --

    M draft-ietf-quic-tls.md (7)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2870.patch
https://github.com/quicwg/base-drafts/pull/2870.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 02 Jul 2019 23:40:16 -0700

kazuho approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870#pullrequestreview-257284725

---

From: Marten Seemann <[email-masked]>
Date: Tue, 02 Jul 2019 23:43:36 -0700

marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870#pullrequestreview-257285866

---

From: Nick Harper <[email-masked]>
Date: Wed, 03 Jul 2019 10:53:08 -0700

I think this also needs to change the first sentence that currently says "Initial packets are protected with a secret derived from the Destination Connection ID field from the client’s first Initial packet of the connection."

If we're attempting to describe the behavior that people currently have implemented (where Initial keys change on a Retry packet but nothing else), the sentence I've quoted above is false.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870#issuecomment-508194040

---

From: Martin Thomson <[email-masked]>
Date: Wed, 03 Jul 2019 18:36:11 -0700

@martinthomson pushed 1 commit.

b71c607b6e43bf5ae79b5859b1aabc6c936ad0bd  First Initial is misleading

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870/files/35c7a5982639ba2e965e0c62faa608b68797cac8..b71c607b6e43bf5ae79b5859b1aabc6c936ad0bd

---

From: ianswett <[email-masked]>
Date: Mon, 08 Jul 2019 18:49:00 -0700

ianswett requested changes on this pull request.

This is a good PR in terms of clarifying the current interop/implied behavior, but I'd like to consider making this a non-editorial issue, since I think we could do this more cleanly.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870#pullrequestreview-259234707

---

From: Marten Seemann <[email-masked]>
Date: Mon, 08 Jul 2019 22:32:53 -0700

> @@ -800,8 +799,10 @@ modifying the contents of packets from future versions.
 The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial
 packets even where the TLS versions offered do not include TLS 1.3.
 
-{{test-vectors-initial}} contains test vectors for the initial packet
-encryption.
+The secrets used for protecting Initial packets changes when a server sends a

singular vs plural

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2870#pullrequestreview-259275767