Subject: [quicwg/base-drafts] Receiving ACKs for 0-RTT (#3855)

From: ekr <[email-masked]>
Date: Tue, 07 Jul 2020 19:20:29 -0700

> A client only receives acknowledgments for its 0-RTT packets once the handshake
is complete.  Consequently, a server might expect 0-RTT packets to start with a

However, this is not necessarily strictly true, because you might have the ACKs in 0.5RTT. Now you might say that the TLS stack reports the handshake as complete as soon as it receives Finished but that's an implementation detail

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3855

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Jul 2020 19:24:16 -0700

I think that this is true.  The server can send before then, but we require that the client not install 1-RTT keys until it considers the handshake complete.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3855#issuecomment-655241885

---

From: Marten Seemann <[email-masked]>
Date: Tue, 07 Jul 2020 20:47:48 -0700

> we require that the client not install 1-RTT keys until it considers the handshake complete.

That's not entirely true. It's the server that needs to hold back keys (namely, the 1-RTT read key) until the handshake completes. The client can use keys as soon as they become available.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3855#issuecomment-655265300

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 07 Jul 2020 21:06:58 -0700

I think @martinthomson is correct in sense that the following three events happen at the same moment on the client side:
* handshake is declared complete
* TLS stack provides the 1-RTT read and write keys
* TLS stack provides ClientFinished

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3855#issuecomment-655270431

---

From: Christian Huitema <[email-masked]>
Date: Tue, 07 Jul 2020 21:08:17 -0700

Martin is correct. There are two different forms of handshake completion: complete when 1rtt can be sent and received, confirmed when the peer is known to be complete. The client cannot receive 0rtt acks before installing 1rtt keys, hence before hanshake is complete.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3855#issuecomment-655270784

---

From: Jana Iyengar <[email-masked]>
Date: Fri, 31 Jul 2020 12:36:58 -0700

Closed #3855 via #3868.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3855#event-3609982767