Subject: [quicwg/base-drafts] Prohibit reading 1-RTT before handshake complete (#3868)

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 23:16:02 -0700

This was never explicit for the client as it is usually not possible.

Closes #3855 in a way that perhaps was not anticipated.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3868

-- Commit Summary --

  * Prohibit reading 1-RTT before handshake complete

-- File Changes --

    M draft-ietf-quic-tls.md (6)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3868.patch
https://github.com/quicwg/base-drafts/pull/3868.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 15 Jul 2020 17:53:05 -0700

@kazuho approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-449436468

---

From: David Schinazi <[email-masked]>
Date: Wed, 15 Jul 2020 18:10:06 -0700

@DavidSchinazi approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-449441348

---

From: Marten Seemann <[email-masked]>
Date: Wed, 15 Jul 2020 18:19:16 -0700

@marten-seemann commented on this pull request.

> @@ -1280,6 +1280,10 @@ A server could receive packets protected with 0-RTT keys prior to receiving a
 TLS ClientHello.  The server MAY retain these packets for later decryption in
 anticipation of receiving a ClientHello.
 
+A client generally receives 1-RTT keys at the same time as the handshake
+completes.  However, a client also MUST NOT process incoming 1-RTT protected
+packets before the TLS handshake is complete.

I'm not sure I understand the logic here. If the client receives the 1-RTT keys at the same time as the handshake completes, how can it possibly use them before that?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-449444110

---

From: Martin Thomson <[email-masked]>
Date: Wed, 15 Jul 2020 18:26:05 -0700

@martinthomson commented on this pull request.

Note the "generally".  It is - in theory - possible for a client to receive keys for TLS before it has completed the handshake.  The simplest example is that the client has all the messages necessary, but the server certificate hasn't been authenticated yet (which is a condition for handshake completion).  As certificate authentication can take time, there is potentially a time where the client could generate keys and use them without being sure of what the server identity is.  Most TLS stacks don't allow that to happen, but it isn't a guarantee that is made anywhere.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#discussion_r455455526

---

From: Marten Seemann <[email-masked]>
Date: Wed, 15 Jul 2020 18:39:03 -0700

@marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-449450111

---

From: ianswett <[email-masked]>
Date: Mon, 27 Jul 2020 09:17:46 -0700

@ianswett approved this pull request.

```suggestion
A client typically receives 1-RTT keys at the same time as the handshake
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-455933568

---

From: Jana Iyengar <[email-masked]>
Date: Mon, 27 Jul 2020 16:38:48 -0700

@janaiyengar commented on this pull request.

Some editorializing might help. How about "Even if it has 1-RTT keys, a client MUST NOT .."

> +Therefore, the server's use of 1-RTT keys is limited to sending data before
 the handshake is complete.  A server MUST NOT process incoming 1-RTT protected

```suggestion
Therefore, the server's use of 1-RTT keys before the handshake is complete is
limited to sending data.  A server MUST NOT process incoming 1-RTT protected
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-456205888

---

From: Martin Thomson <[email-masked]>
Date: Thu, 30 Jul 2020 18:32:47 -0700

@martinthomson pushed 1 commit.

0c08ec7232ef506e1a153cfd33edb1a25936664d  reorder

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868/files/415ae7646ddd5d62810365215893bd9f4ebf55d8..0c08ec7232ef506e1a153cfd33edb1a25936664d

---

From: Martin Thomson <[email-masked]>
Date: Thu, 30 Jul 2020 18:34:11 -0700

758eb2a61eef2544dd75ee6c88970981639cfc0c  Use some of that editorializing

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868/files/0c08ec7232ef506e1a153cfd33edb1a25936664d..758eb2a61eef2544dd75ee6c88970981639cfc0c

---

From: Jana Iyengar <[email-masked]>
Date: Thu, 30 Jul 2020 18:43:56 -0700

@janaiyengar approved this pull request.

a nit, but LGTM

+A client generally receives 1-RTT keys at the same time as the handshake
+completes.  Even if it has 1-RTT secrets, a client also MUST NOT process

```suggestion
completes.  Even if it has 1-RTT secrets, a client MUST NOT process
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#pullrequestreview-458868544

---

From: Martin Thomson <[email-masked]>
Date: Thu, 30 Jul 2020 21:34:02 -0700

c92c8928798b82f0fafb9d83cf03d65d2b043698  -also

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868/files/758eb2a61eef2544dd75ee6c88970981639cfc0c..c92c8928798b82f0fafb9d83cf03d65d2b043698

---

From: Jana Iyengar <[email-masked]>
Date: Fri, 31 Jul 2020 19:36:59 +0000 (UTC)

Merged #3868 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3868#event-3609982765