Subject: Re: [quicwg/base-drafts] Transport parameters can be used before they are authentic (#4463)

From: ianswett <[email-masked]>
Date: Tue, 05 Jan 2021 15:13:51 -0800

@ianswett commented on this pull request.

I think the limitations could be a be clearer, but heading in a good direction.

> @@ -1811,10 +1812,12 @@ EncryptedExtensions messages without the quic_transport_parameters extension
 MUST close the connection with an error of type 0x16d (equivalent to a fatal TLS
 missing_extension alert, see {{tls-errors}}).
 
-While the transport parameters are technically available prior to the completion
-of the handshake, they cannot be fully trusted until the handshake completes,
-and reliance on them should be minimized.  However, any tampering with the
-parameters will cause the handshake to fail.
+Transport parameters become available prior to the completion of the handshake.
+Using these values earlier than handshake completion is necessary at the server

I'm not sure it's necessary to send 1-RTT packets prior to handshake completion, but it is necessary to send many things, such as data on streams in 0.5RTT packets.

Also, the way this is written, it could be read as sending 1-RTT packets from server to client requires using these values prior to handshake completion, which I realize isn't your intent.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4463#pullrequestreview-562203248

---

From: Jana Iyengar <[email-masked]>
Date: Tue, 05 Jan 2021 21:10:52 -0800

@janaiyengar commented on this pull request.

> +Using these values earlier than handshake completion is necessary at the server
+if it wishes to send 1-RTT packets to the client. However, the value of

```suggestion
A server might use these values earlier than handshake completion. However, the value of
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4463#pullrequestreview-562328966

---

From: Martin Thomson <[email-masked]>
Date: Thu, 07 Jan 2021 01:46:32 -0800

@martinthomson pushed 1 commit.

46b211e418eb1d6edf56f66127b9d59a6376afa1  Sure, fine

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4463/files/3d3a3775d461036bf68f0e2b9f3217f2eb05f5c3..46b211e418eb1d6edf56f66127b9d59a6376afa1

---

From: Martin Thomson <[email-masked]>
Date: Thu, 07 Jan 2021 01:47:22 -0800

484cba8edd7a7fb23a706b3cf71b7bd83556d6b7  Wrap

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4463/files/46b211e418eb1d6edf56f66127b9d59a6376afa1..484cba8edd7a7fb23a706b3cf71b7bd83556d6b7

---

From: Martin Thomson <[email-masked]>
Date: Sun, 10 Jan 2021 18:21:21 -0800

Merged #4463 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4463#event-4188719285