Subject: [quicwg/base-drafts] Ben Kaduk's TLS Comment 22 (#4498)

From: Lucas Pardue <[email-masked]>
Date: Tue, 05 Jan 2021 18:59:34 -0800

@kaduk said:

> Section 6.3
> 
>    The process of creating new packet protection keys for receiving
>    packets could reveal that a key update has occurred.  An endpoint MAY
>    perform this process as part of packet processing, but this creates a
>    timing signal that can be used by an attacker to learn when key
>    updates happen and thus the value of the Key Phase bit in certain
>    packets.  Endpoints MAY instead defer the creation of the next set of
>    receive packet protection keys until some time after a key update
>    completes, up to three times the PTO; see Section 6.5.
> 
> (editorial) I think this paragraph (and following) might need a rewrite,
> since the phrase "new keys" in the context of a key update could be
> ambiguous.  In particular, if we are considering the process of a key
> update from generation M to generation N, this text only seems to make
> sense if the "new keys" whose generation is being discussed is
> generation O (i.e., ones that are not being used to send traffic yet by
> anybody), but it is easy to misread "new keys" as being "the ones
> installed/activated for use as part of the key update process".  Perhaps
> the guidance that endpoints are to maintain both current and next keys
> in normal operation should be moved earlier, with the context that you
> need to be prepared to handle any valid incoming packets (which includes
> those using both current and next keys, since the peer can initiate a
> key update) without a timing channel for when key generation is
> occurring.  (There may be some similar text in §9.5 that would be
> updated in accordance with any changes made here.)
> 
>    Once generated, the next set of packet protection keys SHOULD be
>    retained, even if the packet that was received was subsequently
>    discarded.  [...]
> 
> What is "the packet" that was received?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4498

---

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 22:39:47 -0800

I can see an obvious missing word in there at a minimum.  I can see some opportunities for clarification here though, so I'll give it a go.  Breaking the ordering dependencies between sections is tricky though.  It might just be that we need a little redundancy.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4498#issuecomment-755115126

---

From: Martin Thomson <[email-masked]>
Date: Sun, 10 Jan 2021 18:25:38 -0800

Closed #4498 via #4577.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4498#event-4188724370