tlswg / tls13-spec

TLS 1.3 Specification
563 stars 159 forks source link

Too many KeyUpdates risk key collision within a connection #1257

Closed kaduk closed 1 year ago

kaduk commented 2 years ago

In https://github.com/tlswg/dtls13-spec/pull/257 we added some text to DTLS about how rekeying too many times (2^64 is allowed with the 64-bit DTLS 1.3 epoch) risks key reuse within a connection, and accompanied it with a MUST NOT guidance to rekey more than 2^48 times (but receivers MUST NOT enforce the rule); this overrides the usual MUST-level requirement to match an "update_requested" KeyUpdate with another KeyUpdate before sending more data.

It seems that some similar considerations apply for non-D TLS as well.