Subject: Re: [quicwg/base-drafts] Initial secrets do not change after Retry (#2878)

From: Mike Bishop <[email-masked]>
Date: Wed, 07 Aug 2019 12:39:53 -0700

MikeBishop commented on this pull request.

> @@ -771,8 +771,7 @@ TLS 1.3 (see {{initial-secrets}}).
 ## Initial Secrets {#initial-secrets}
 
 Initial packets are protected with a secret derived from the Destination
-Connection ID field from the client's first Initial packet of the
-connection. Specifically:
+Connection ID field from the client's Initial packet. Specifically:

Why this change, when it removes the precision about *which* Initial packet?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#pullrequestreview-272185275

---

From: ianswett <[email-masked]>
Date: Wed, 07 Aug 2019 12:59:40 -0700

@ianswett pushed 1 commit.

dcae1c4a8bb276730c75a3e1bba79d4ec451dd53  Mike's question

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878/files/8efdac85fb5e0181b4b1aa3bc825c461f659c049..dcae1c4a8bb276730c75a3e1bba79d4ec451dd53

---

From: ianswett <[email-masked]>
Date: Wed, 07 Aug 2019 13:00:29 -0700

ianswett commented on this pull request.

I can't remember why I changed that, reverted.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#discussion_r311737116

---

From: Martin Thomson <[email-masked]>
Date: Wed, 07 Aug 2019 21:12:35 -0700

martinthomson approved this pull request.

This is a good change.

> @@ -804,17 +804,14 @@ modifying the contents of packets from future versions.
 The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial
 packets even where the TLS versions offered do not include TLS 1.3.
 
+The secrets used for protecting Initial packets do not change during the
+connection, even after receiving a Retry.  A server that sends a Retry

```suggestion
connection, even though the destination connection ID in client Initial packets
changes after receiving a Retry.  A server that sends a Retry
```

> @@ -804,17 +804,14 @@ modifying the contents of packets from future versions.
 The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial
 packets even where the TLS versions offered do not include TLS 1.3.
 
+The secrets used for protecting Initial packets do not change during the
+connection, even after receiving a Retry.  A server that sends a Retry
+therefore needs to either remember the original connection ID and Initial
+protection keys or save the original connection ID in the Retry token.

```suggestion
or save the original connection ID in the Retry token.
```

> @@ -804,17 +804,14 @@ modifying the contents of packets from future versions.
 The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial
 packets even where the TLS versions offered do not include TLS 1.3.
 
+The secrets used for protecting Initial packets do not change during the
+connection, even after receiving a Retry.  A server that sends a Retry
+therefore needs to either remember the original connection ID and Initial

No strict need to keep Initial (packet) protection keys.

```suggestion
therefore needs to either remember the original connection ID
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#pullrequestreview-272334825

---

From: Mike Bishop <[email-masked]>
Date: Tue, 13 Aug 2019 08:33:35 -0700

#2926 implies a good point:  After this change, the "Initial DCID" and the "original DCID" are always the same.  We should collapse the terms as part of this PR or in a follow-up if we take it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#issuecomment-520886357