Subject: Re: [quicwg/base-drafts] Initial secrets do not change after Retry (#2878)

From: ianswett <[email-masked]>
Date: Fri, 06 Sep 2019 14:13:20 -0700

@ianswett pushed 1 commit.

835490f5b5d268afe36b22be81d346e96eeb54da  Update draft-ietf-quic-tls.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878/files/dcae1c4a8bb276730c75a3e1bba79d4ec451dd53..835490f5b5d268afe36b22be81d346e96eeb54da

---

From: ianswett <[email-masked]>
Date: Fri, 06 Sep 2019 14:13:47 -0700

076df56d806ac324dd2b632cd5388427612bc82d  Update draft-ietf-quic-tls.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878/files/835490f5b5d268afe36b22be81d346e96eeb54da..076df56d806ac324dd2b632cd5388427612bc82d

---

From: ianswett <[email-masked]>
Date: Fri, 06 Sep 2019 14:14:08 -0700

f31868fa2adf17c0e9f9d0a8fc19b351876df1b0  Update draft-ietf-quic-tls.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878/files/076df56d806ac324dd2b632cd5388427612bc82d..f31868fa2adf17c0e9f9d0a8fc19b351876df1b0

---

From: ianswett <[email-masked]>
Date: Fri, 06 Sep 2019 14:19:07 -0700

58cd0b4b24118866353d0eaa358bd03e57dec90b  Clarified that saving Connection ID is not new

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878/files/f31868fa2adf17c0e9f9d0a8fc19b351876df1b0..58cd0b4b24118866353d0eaa358bd03e57dec90b

---

From: ianswett <[email-masked]>
Date: Fri, 06 Sep 2019 14:19:55 -0700

ianswett commented on this pull request.

> @@ -804,17 +803,14 @@ modifying the contents of packets from future versions.
 The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial
 packets even where the TLS versions offered do not include TLS 1.3.
 
+The secrets used for protecting Initial packets do not change during the
+connection, even after receiving a Retry.  A server that sends a Retry
+therefore needs to either remember Initial protection keys or save them

Good point, MT suggested some simplifications to the text and I added a sentence clarifying that this is not a new requirement, it just changes when the connection ID is used.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#discussion_r321914284

---

From: Martin Thomson <[email-masked]>
Date: Sun, 08 Sep 2019 18:19:53 -0700

martinthomson commented on this pull request.

> @@ -805,10 +805,12 @@ The HKDF-Expand-Label function defined in TLS 1.3 MUST be used for Initial
 
 The secrets used for protecting Initial packets do not change during the
-connection, even though the destination connection ID in client Initial packets
-changes after receiving a Retry.  A server that sends a Retry
-therefore needs to either remember the original connection ID
-or save the original connection ID in the Retry token.
+connection, even though the destination connection ID in client Initial
+packets changes after receiving a Retry.  A server that sends a Retry
+therefore needs to either remember the original connection ID or save
+the original connection ID in the Retry token.  Because the initial
+connection ID is included in the server's transport parameters, the only
+difference is when in the packet processing this connection ID is utilized.

This reads like justification for a change, rather than static text.  How about:

> The initial connection ID is needed by a server to reconstruct packet protection keys and so that it can produce the correct value for the original_connection_id transport parameter.

And are we using "initial" or "original" here?  I went with original on the basis that it distinguished this from Initial packets, but it's not clear to be that that distinction is necessary, or even a good idea.  After all, this connection ID is what is driving packet protection for those packets; the linkage might be useful.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#pullrequestreview-285248757

---

From: Mike Bishop <[email-masked]>
Date: Mon, 09 Sep 2019 09:44:13 -0700

MikeBishop commented on this pull request.

At the time, we were trying to avoid confusion between the _original_ DCID, which generated the keys, and the DCID in the current Initial.  It was a useful distinction in the old design.  With this change, I think that distinction is no longer useful.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878#discussion_r322343677

---

From: ianswett <[email-masked]>
Date: Tue, 10 Sep 2019 14:59:27 -0700

9c45730ca607fd1961fff9505db0841ca9430b10  Martin's suggestion

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2878/files/58cd0b4b24118866353d0eaa358bd03e57dec90b..9c45730ca607fd1961fff9505db0841ca9430b10