Subject: [quicwg/base-drafts] Final salt and retry keys (#4431)

From: Martin Thomson <[email-masked]>
Date: Tue, 08 Dec 2020 15:49:38 -0800

Also, examples use final version numbers.

IMPORTANT: the TLS extension codepoint needs to be updated, both in the
text and in the examples (which will result in changes to authentication
tags and the affected ciphertext).
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4431

-- Commit Summary --

  * Final salt and retry keys

-- File Changes --

    M draft-ietf-quic-tls.md (144)
    M protection-samples.js (11)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4431.patch
https://github.com/quicwg/base-drafts/pull/4431.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431

---

From: Alessandro Ghedini <[email-masked]>
Date: Wed, 09 Dec 2020 03:26:12 -0800

I plugged the test vectors into the quiche test suite and it checks out https://github.com/cloudflare/quiche/tree/its-the-final-saltdown

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#issuecomment-741710941

---

From: David Schinazi <[email-masked]>
Date: Wed, 09 Dec 2020 09:07:56 -0800

@DavidSchinazi commented on this pull request.

> @@ -947,7 +947,7 @@ from the Destination Connection ID field from the client's first Initial
 packet.
 
 This secret is determined by using HKDF-Extract (see Section 2.2 of
-{{!HKDF=RFC5869}}) with a salt of 0xafbfec289993d24c9e9786f19c6111e04390a899
+{{!HKDF=RFC5869}}) with a salt of 0x38762cf7f55934b34d179ae6a4c80cadccbb7f0a

Out of curiosity, how were these new salts derived? Are we going to learn after publication that this was a hash of @martinthomson 's social security number?

> @@ -2105,67 +2105,67 @@ The unprotected header includes the connection ID and a 4-byte packet number
 encoding for a packet number of 2:
 
 ~~~
-c3ff000020088394c8f03e5157080000449e00000002
+c300000001088394c8f03e5157080000449e00000002

Is this implying that implementors of draft-33 should use the `00000001` version?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#pullrequestreview-548404769

---

From: Dmitri Tikhonov <[email-masked]>
Date: Wed, 09 Dec 2020 14:04:40 -0800

@dtikhonov commented on this pull request.

 packet.

My guess is that he rolled some D&D dice.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539682322

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Dec 2020 18:42:03 -0800

@martinthomson commented on this pull request.

 ~~~

Yes, see #4430.  Though I would (strongly) encourage people not to deploy that version until we get a little further through the process.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539801402

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Dec 2020 18:42:49 -0800

packet.

Revealing how it was done would ruin the mystery.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539801719

---

From: David Schinazi <[email-masked]>
Date: Wed, 09 Dec 2020 19:01:11 -0800

~~~

Can you clarify what "a little further through the process" means? Having folks deploy `00000001` before the RFC is published in its immutable glory could prevent us from making last-minute fixes.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539807997

---

From: David Schinazi <[email-masked]>
Date: Wed, 09 Dec 2020 19:04:27 -0800

packet.

I mean, I was sort of hoping for us to use a provable process here à la NomCom selection (pick a future date and hash some unpredictable values like weather in San Francisco and the AAPL stock price on that day) to ensure that @martinthomson doesn't accept money from AnOnyMoUs so they don't hack all our initial packets. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539809107

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Dec 2020 19:26:11 -0800

~~~

Yeah.  I'm just a little scared of what the IESG might uncover.  Certain IESG members have a reputation for being quite thorough.  They probably won't find anything substantive, but I would like to keep the option just a tiny bit available until their reviews are in.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539816606

---

From: David Schinazi <[email-masked]>
Date: Wed, 09 Dec 2020 19:44:32 -0800

~~~

To be honest I'm not personally worried about IESG review; I'm more concerned about what we'll find when we actually deploy this protocol in production (no one has launched 0-RTT or migration yet as far as I know).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539822823

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 09 Dec 2020 20:35:36 -0800

@janaiyengar commented on this pull request.

 packet.

Hacking initial packets doesn't need a lot of mystery-solving -- the salt is published here :-)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539838435

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 09 Dec 2020 20:40:38 -0800

~~~

Given that everyone is retaining h3-29, I would suggest that we continue with that until at least after IESG review. There's nothing left in the process at this point that is expected to wait until we have more deployment experience, given that IETF LC is officially complete.

I understand and agree with your concern, @DavidSchinazi, but given that we don't have a specific point in time where we can expect to see migration or 0-RTT deployed, I don't see that waiting is a useful strategy. I would argue that we can leverage v2 for this if we need to fix something.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539840058

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Dec 2020 21:16:23 -0800

~~~

I want final values in the document, because they will need to be tested.  I've already found one problem as a result of implementing this change.  I don't want any surprises.  That said, yes, keep up with the -29 deployments for now.  It's just as good.

And you just reminded me that I need to tweak the ALPN values in the sample.  That's going to suck, but best that I caught it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539851498

---

From: Martin Thomson <[email-masked]>
Date: Wed, 09 Dec 2020 21:25:40 -0800

~~~

And I just worked out that the example uses an ALPN of "alpn", so there is no need to update.  Of course, someone could call me on that being a potentially valid value rather than one reserved for examples, but then I wouldn't care.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539854525

---

From: David Schinazi <[email-masked]>
Date: Wed, 09 Dec 2020 23:15:22 -0800

packet.

@janaiyengar yes that was a joke :-) but more seriously I was truly expecting us to come up with a convoluted way to establish this salt for the final version to ensure it is impartial. Not that I'll lie down on the tracks over this, as a wise person one said...

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539927892

---

From: David Schinazi <[email-masked]>
Date: Wed, 09 Dec 2020 23:17:24 -0800

~~~

I'm in agreement with you that we need to test a few things before publication, it's just the matter of when we switch to the official codepoints. But I think you did hit the nail on the head that at the end of the day, it's going to be h3-29 for now, then v1 when available - nothing we do between the two will actually matter

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#discussion_r539929565

---

From: Martin Thomson <[email-masked]>
Date: Thu, 10 Dec 2020 17:28:16 -0800

@martinthomson pushed 3 commits.

cb02592f960ea96f3ff54d61768df9242064d893  Add final TLS extension codepoint
1b2efdf250b306b82ea2069a483131e91fabadb8  Revert switch to 46 as the codepoint
50e2647652bb20fe4a9cdf06a81cd60e54e9ec77  Use the new codepoint (57) for the TLS extension

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431/files/4180c243984ac8f33781f7e89185344c59ce9be0..50e2647652bb20fe4a9cdf06a81cd60e54e9ec77

---

From: Nick Banks <[email-masked]>
Date: Thu, 10 Dec 2020 19:06:52 -0800

@nibanks approved this pull request.

New values seem to work in my testing.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#pullrequestreview-549770238

---

From: Martin Thomson <[email-masked]>
Date: Sun, 13 Dec 2020 14:18:15 -0800

Merged #4431 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4431#event-4106510566