Discard server 0-RTT read key when QUIC TLS handshake completes
Once the handshake is complete (i.e. the server has received the client's
Finished message), there shouldn't be any more messages in flight from the
client under the 0-RTT keys. If a lost 0-RTT packet eventually arrives late
(after the Finished), the server now won't be able to decrypt it, and
instead will need to wait for the retransmission to arrive (which is
presumably already en route).
Protected by disabled flag quic_enable_zero_rtt_for_tls
PiperOrigin-RevId: 314976141
Change-Id: I4b668e79795a942c7cec08a3cfb8085b182df781
diff --git a/quic/core/tls_server_handshaker.cc b/quic/core/tls_server_handshaker.cc
index 7d97bdb..58f75e4 100644
--- a/quic/core/tls_server_handshaker.cc
+++ b/quic/core/tls_server_handshaker.cc
@@ -380,6 +380,7 @@
handshaker_delegate()->OnOneRttKeysAvailable();
handshaker_delegate()->DiscardOldEncryptionKey(ENCRYPTION_HANDSHAKE);
handshaker_delegate()->DiscardOldDecryptionKey(ENCRYPTION_HANDSHAKE);
+ handshaker_delegate()->DiscardOldDecryptionKey(ENCRYPTION_ZERO_RTT);
}
ssl_private_key_result_t TlsServerHandshaker::PrivateKeySign(
