Subject: [TLS] TLS 1.3 Record Boundaries

From: Andrei Popov <[email-masked]>
Date: Tue, 24 Oct 2017 00:42:01 +0000

Draft-21 says:
"Handshake messages MUST NOT span key changes.  Implementations
  MUST verify that all messages immediately preceding a key change
  align with a record boundary; if not, then they MUST terminate the
  connection with an "unexpected_message" alert.  Because the
  ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
 messages can immediately precede a key change, implementations
  MUST send these messages in alignment with a record boundary."

It is not clear to me what "sending messages in alignment with a record boundary" means.
Does it mean that each record is either all plaintext or all encrypted with key X? And therefore one cannot combine, e.g., ServerHello (plaintext) and EncryptedExtensions (encrypted with the handshake traffic key) messages in one record?

Thanks,

Andrei

---

From: Peter Wu <[email-masked]>
Date: Tue, 24 Oct 2017 11:23:15 +0100

On Tue, Oct 24, 2017 at 12:42:01AM +0000, Andrei Popov wrote:
> Does it mean that each record is either all plaintext or all encrypted with key X?

Yes, where key X could be the client/server handshake, traffic secret,
etc.

> And therefore one cannot combine, e.g., ServerHello (plaintext) and
> EncryptedExtensions (encrypted with the handshake traffic key)
> messages in one record?

Correct. And before you switch to a new cipher context, you MUST check
that you have no more remaining data in the record. For example, no more
data is allowed in the same record following the Server Hello. And the
record after the Server Hello, there is an encrypted record containing
Encrypted Extensions (encrypted with the server handshake secret).
-- 
Kind regards,
Peter Wu
https://lekensteyn.nl

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 24 Oct 2017 15:53:50 +0300

>   MUST send these messages in alignment with a record boundary."

Edge case: Finished is also part of post-handshake auth (*puke*),
which does not trigger key change. And from some cryptographic
analysis, one might get an idea to immediately send a KeyUpdate
requesting reciproal update afterwards (not that I think that is
actually necressary or even helpful).

-Ilari

---

From: Hubert Kario <[email-masked]>
Date: Mon, 30 Oct 2017 12:10:44 +0100

> It is not clear to me what "sending messages in alignment with a record

Reminder: a single record layer message can include multiple handshake 
messages. In particular, it can include only a part of a single message 
(beginning, middle or end).

To answer the question: it means that the last record message with handshake 
message content must have included the end part of that handshake message and 
first byte of a "key change" message needs to be the first byte of a record 
message.

Note that this is a change from TLS1.2 where for renegotiation, the 
application data could continue to be transmitted during the handshake and be 
interspaced with handshake messages, and the handshake messages could be 
fragmented.

> And therefore one cannot combine, e.g.,
> ServerHello (plaintext) and EncryptedExtensions (encrypted with the
> handshake traffic key) messages in one record?

given that it's the record layer that is encryped, not the handshake message, 
I'm not sure how would you put an unencrypted and encrypted handshake message 
into a single record...
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic