Subject: [quicwg/base-drafts] for Retry integrity protection, use values that can be derived from AEAD API (#3365)

From: Kazuho Oku <[email-masked]>
Date: Sat, 18 Jan 2020 18:53:20 -0800

You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3365

-- Commit Summary --

  * for Retry integrity protection, use values that can be derived from AEAD API

-- File Changes --

    M draft-ietf-quic-tls.md (8)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3365.patch
https://github.com/quicwg/base-drafts/pull/3365.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365

---

From: Martin Thomson <[email-masked]>
Date: Sun, 19 Jan 2020 22:33:05 -0800

martinthomson approved this pull request.

If this is the outcome, then this seems fine.

>  - The plaintext, P, is empty.
 - The associated data, A, is the contents of the Retry Pseudo-Packet, as
   illustrated in {{retry-pseudo}}:
 
+The secret key and the nonce are values derived by calling HKDF-Expand-Label
+using 0x656e61e336ae9417f7f0edd8d78d461e2aa7084aba7a14c1e9f726d55709169a as the
+secret, with labels being "quic key" and "quic iv".

I would cite the section where we describe how to use HKDF-Expand-Label in QUIC.  Otherwise people will be inclined to ask things like "What is L?", when that is more clearly described in that section.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365#pullrequestreview-345100123

---

From: Kazuho Oku <[email-masked]>
Date: Sun, 19 Jan 2020 22:51:15 -0800

@kazuho pushed 1 commit.

6f792b75d5580acc9e50f791e2d3304470210980  refer to Packet Protection Keys

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365/files/07ec05b0c2e7bfb4e1f9f64b442352871be39a46..6f792b75d5580acc9e50f791e2d3304470210980

---

From: Kazuho Oku <[email-masked]>
Date: Sun, 19 Jan 2020 22:51:48 -0800

kazuho commented on this pull request.

Thank you for the suggestion. Done in 6f792b7.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365#discussion_r368390526

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 21 Jan 2020 14:39:26 -0800

janaiyengar approved this pull request.

I think this is useful -- we should merge this.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365#pullrequestreview-346241577

---

From: Martin Thomson <[email-masked]>
Date: Tue, 21 Jan 2020 15:12:16 -0800

Merged #3365 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365#event-2968128513

---

From: Martin Thomson <[email-masked]>
Date: Tue, 21 Jan 2020 17:36:15 -0800

Just to set expectations, I think that I want to reserve the ability to pick new values for these.  Just as there will be a new value for the Initial salt when we publish an RFC, this probably needs a new value at the same time.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3365#issuecomment-576967782