Subject: [quicwg/base-drafts] Rewrite text on timing leaks for key generation (#4577)

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 22:40:53 -0800

Some of this is just forward reference, but it does need a little more
context.

Also, there was a missing word.

Closes #4498.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/4577

-- Commit Summary --

  * Rewrite text on timing leaks for key generation

-- File Changes --

    M draft-ietf-quic-tls.md (16)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/4577.patch
https://github.com/quicwg/base-drafts/pull/4577.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577

---

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 22:44:37 -0800

@martinthomson pushed 1 commit.

3d699daae4a7cefc47fc8255c239174607cab806  Use current, next, subsequent

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577/files/9681fb054215fb6a7e36d80e524ff59fa11bdd5c..3d699daae4a7cefc47fc8255c239174607cab806

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 05 Jan 2021 22:55:08 -0800

@kazuho commented on this pull request.

> @@ -1576,12 +1576,16 @@ remove packet protection, and results in all packets with an invalid Key Phase
 bit being rejected.
 
 The process of creating new packet protection keys for receiving packets could
-reveal that a key update has occurred.  An endpoint MAY perform this process as
-part of packet processing, but this creates a timing signal that can be used by
-an attacker to learn when key updates happen and thus the value of the Key Phase
-bit in certain packets.  Endpoints MAY instead defer the creation of the next
-set of receive packet protection keys until some time after a key update
-completes, up to three times the PTO; see {{old-keys-recv}}.
+reveal that a key update has occurred. An endpoint MAY generate new keys as
+part of packet processing, but this creates a timing signal that could be used
+by an attacker to learn when key updates happen and thus leak the value of the
+Key Phase bit.
+
+Endpoints are generally expected to have current and next receive packet
+protection keys available. For a short period after a key update completes, up
+to three times the PTO, endpoints MAY defer generation of the next set of
+receive packet protection keys and use old keys instead. This allows endpoints

```suggestion
receive packet protection keys. This allows endpoints
```

"instead" is confusing, because a receiver that has three read keys is expected to use both the new key and old key to decrypt packets carrying the key phase bit that match either of those two keys.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#pullrequestreview-562361627

---

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 22:56:11 -0800

c03a5360703b9b2c516fba442bc7437b05351990  Don't bother with that

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577/files/3d699daae4a7cefc47fc8255c239174607cab806..c03a5360703b9b2c516fba442bc7437b05351990

---

From: Martin Thomson <[email-masked]>
Date: Tue, 05 Jan 2021 22:56:20 -0800

@martinthomson commented on this pull request.

 bit being rejected.

Works for me.  Thanks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#discussion_r552401493

---

From: Jana Iyengar <[email-masked]>
Date: Wed, 06 Jan 2021 22:37:36 -0800

@janaiyengar approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#pullrequestreview-563241727

---

From: Mike Bishop <[email-masked]>
Date: Thu, 07 Jan 2021 13:30:41 -0800

This also closes #4499, no?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#issuecomment-756397367

---

From: Martin Thomson <[email-masked]>
Date: Thu, 07 Jan 2021 16:03:21 -0800

bit being rejected.

```suggestion
to the PTO, endpoints MAY defer generation of the next set of
```

@janaiyengar, @kazuho can you check this?  I think that this is correct and matches the recommendation that is cited.  3PTO is the period over which we ask endpoints to refrain from key updates.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#pullrequestreview-563915188

---

From: kaduk <[email-masked]>
Date: Sat, 09 Jan 2021 19:47:20 -0800

@kaduk approved this pull request.

This is a big help; thank you!

 bit being rejected.

One PTO is also what is mentioned at L1638-L1640.

 bit being rejected.

I think "defer generation of the subsequent set" might be good (and be consistent with L1640).  (Not phrasing as a suggestion since the two suggestions would conflict.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#pullrequestreview-564826247

---

From: Kazuho Oku <[email-masked]>
Date: Sun, 10 Jan 2021 00:04:43 -0800

bit being rejected.

:+1: I think that the suggested change is correct.

Our recommendations are that the _receiver_ keeps the old keys for one PTO, the _sender_ delays the next key update for at least three PTO after it receives an ACK for the current key update. This paragraph is talking about the receiver, so it should be one PTO.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#discussion_r554528718

---

From: Martin Thomson <[email-masked]>
Date: Sun, 10 Jan 2021 18:07:13 -0800

51f3305947af552f5959f3f8f24c7a2a43b79aae  one PTO, not three

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577/files/c03a5360703b9b2c516fba442bc7437b05351990..51f3305947af552f5959f3f8f24c7a2a43b79aae

---

From: Martin Thomson <[email-masked]>
Date: Sun, 10 Jan 2021 18:25:37 -0800

Merged #4577 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4577#event-4188724369