Closed
Bug 1304603
Opened 9 years ago
Closed 9 years ago
Switch to handshake traffic keys when sending alerts while processing server flight
Categories
(NSS :: Libraries, defect)
Tracking
(Not tracked)
RESOLVED
FIXED
Future
People
(Reporter: mt, Assigned: ekr)
References
Details
On the client, NSS currently switches to using handshake traffic keys when it sends the client's second flight. This is great for 0-RTT, because it means that we can keep sending 0-RTT until we have all of the server's flight, but it's terrible for the alerts we generate as a result of receiving the server's flight.
If we aren't doing 0-RTT, we send the alert in the clear, which the server is incapable of decrypting because it has already changed to expect the handshake traffic keys. We should instead switch to the handshake traffic keys. If we are doing 0-RTT, we should first send end_of_early_data so that the server switches to the handshake traffic keys if it is successfully decrypting 0-RTT.
|
Reporter | |
Comment 1•9 years ago
|
||
Flags: needinfo?(ekr)
|
|
Reporter | |
Comment 2•9 years ago
|
||
After talking this over with ekr, the plan here is to NOT change anything. That means that if we are doing 0-RTT, we will still be OK, if we are not doing 0-RTT, then the alerts are going to be send in the clear. That's bad news for the server, which won't be able to decrypt them, but it's good news for debugging because alerts won't need to be decrypted to make sense of them.
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(ekr)
Resolution: --- → WONTFIX
|
|
Reporter | |
Comment 3•9 years ago
|
||
We have a new patch now: https://nss-review.dev.mozaws.net/D397
This is a partial fix, but it should help. The final solution requires some extra work on the server to identify alerts. For instance, this won't properly detect cleartext alerts at the server (those sent in response to errors in ServerHello), and it won't work if the server accepts 0-RTT (because the client doesn't send EOED). The fix for the former is to look at the content type and to not insist on decryption; the fix for the latter is trial decryption.
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
|
|
Reporter | |
Comment 4•9 years ago
|
||
Assignee: nobody → ekr
Status: REOPENED → RESOLVED
Closed: 9 years ago → 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → Future
You need to log in
before you can comment on or make changes to this bug.
Description
•