Extended Key Update for Transport Layer Security (TLS) 1.3

Extended Key Update for Transport Layer Security (TLS) 1.3 Siemens

hannes.tschofenig@gmx.net

Nokia

kondtir@gmail.com

Münster Univ. of Applied Sciences

tuexen@fh-muenster.de

Siemens

steffen.fries@siemens.com

Zscaler

yrosomakho@zscaler.com

Security Transport Layer Security Internet-Draft TLS 1.3 ensures forward secrecy by performing an ephemeral Diffie-Hellman key exchange during the initial handshake, protecting past communications even if a party's long-term keys (typically a private key with a corresponding certificate) are later compromised. While the built-in KeyUpdate mechanism allows application traffic keys to be refreshed during a session, it does not incorporate fresh entropy from a new key exchange and therefore does not provide post-compromise security. This limitation can pose a security risk in long-lived sessions, such as those found in industrial IoT or telecommunications environments. To address this, this specification defines an extended key update mechanism that performs a fresh execution of the key exchange negotiated during the initial handshake within an active session to support post-compromise security. By forcing attackers to exfiltrate new key material repeatedly, this approach mitigates the risks associated with static key compromise. Regular renewal of session keys helps contain the impact of such compromises. The extension is applicable to both TLS 1.3 and DTLS 1.3.

Introduction The Transport Layer Security (TLS) 1.3 protocol provides forward secrecy by using fresh ephemeral key exchange during the initial handshake. In the base protocol, this key exchange is performed with (EC)DHE. By registering new NamedGroup codepoints, TLS specifications also define hybrid and post-quantum key exchange mechanisms for the same purpose. This ensures that encrypted communication remains confidential even if an attacker later obtains a party's long-term private key, protecting against passive adversaries who record encrypted traffic for later decryption. TLS 1.3 also includes a KeyUpdate mechanism that allows traffic keys to be refreshed during an established session. However, this mechanism does not provide post-compromise security, as it applies only a key derivation function to the previous application traffic secret as input. While this design is generally sufficient for short-lived connections, it may present security limitations in scenarios where sessions persist for extended periods, such as in industrial IoT or telecommunications systems, where continuous availability is critical and session renegotiation or resumption is impractical. Earlier versions of TLS supported session renegotiation, which allowed peers to negotiate fresh keying material, including performing new Diffie-Hellman exchanges during the session lifetime. Due to protocol complexity and known vulnerabilities, renegotiation was first restricted by and ultimately removed in TLS 1.3. While the KeyUpdate message was introduced to offer limited rekeying functionality, it does not fulfill the same cryptographic role as renegotiation and cannot refresh the TLS main secret and consequently cannot derive new secrets from fresh key exchange input. This limitation applies regardless of whether the session was established with traditional (EC)DHE, a post-quantum/traditional (PQ/T) hybrid exchange, or a post-quantum KEM exchange. Security guidance from national agencies, such as ANSSI (France ), recommends the periodic renewal of cryptographic keys during long-lived sessions to limit the impact of key compromise. This approach encourages designs that force an attacker to perform dynamic key exfiltration, as defined in . Dynamic key exfiltration refers to attack scenarios where an adversary must repeatedly extract fresh keying material to maintain access to protected data, increasing operational cost and risk for the attacker. In contrast, static key exfiltration, where the TLS main secret is extracted once and reused, poses a greater long-term threat, especially when session keys are not refreshed with fresh key exchange input rather than key derivation. This specification defines a TLS extension that introduces an extended key update mechanism for sessions established with traditional (EC)DHE, hybrid PQ/T hybrid key exchange, or post-quantum KEM exchange. Unlike the standard key update, this mechanism allows peers to inject fresh key exchange input from the negotiated mechanism into an active session. By periodically rerunning the negotiated key exchange, this extension enables the derivation of new traffic keys. Compromise of prior traffic keys does not suffice to derive the new traffic keys. As noted in , this approach mitigates the risk of static key exfiltration and shifts the attacker burden toward dynamic key exfiltration. The proposed extension is applicable to both TLS 1.3 and DTLS 1.3 . For clarity, the term "TLS" is used throughout this document to refer to both protocols unless otherwise specified.

Terminology and Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. In this document, "standard key update" refers to the KeyUpdate procedure defined in , with traffic secret derivation as specified in . "Extended key update" refers to the procedure specified in this document. For terminology regarding traditional and PQ/T hybrid algorithms please see . In this document, we use the term post-compromise security, as defined in . The threat model in describes the assumed compromise of connection state and the conditions for recovery. Unless otherwise specified, all references to traffic keys in this document refer to application traffic keys and because the Extended Key Update procedure occurs after the handshake phase has completed, no handshake traffic keys are involved. In this document, send key refers to the [sender]_write_key, and receive key refers to the [receiver]_write_key. These keys are derived from the active client_application_traffic_secret_N and server_application_traffic_secret_N, as defined in (D)TLS 1.3 , and are replaced with new ones after each successful Extended Key Update. Generation N refers to client_/server_application_traffic_secret_N, exporter_secret_N, and transcript_hash_N. Generation 0 is established by the initial handshake, and each Extended Key Update establishes the next generation, following .

Negotiating the Extended Key Update Client and servers use the TLS flags extension to indicate support for the functionality defined in this document. We call this flag "Extended_Key_Update" flag. The "Extended_Key_Update" flag proposed by the client in the ClientHello (CH) MUST be acknowledged in the EncryptedExtensions (EE), if the server also supports the functionality defined in this document and is configured to use it. If the "Extended_Key_Update" flag is not set, servers ignore any of the functionality specified in this document and applications that require post-compromise security will have to initiate a full handshake.

Extended Key Update Messages If the client and server agree to use the extended key update mechanism, the standard key update MUST NOT be used. In this case, the extended key update fully replaces the standard key update functionality. Implementations that receive a standard KeyUpdate message after successfully negotiating the Extended Key Update functionality MUST terminate the connection with an "unexpected_message" alert. The extended key update messages are signaled in a new handshake message named ExtendedKeyUpdate (EKU), with an internal uint8 message subtype indicating its role. This specification defines three ExtendedKeyUpdate message subtypes:

key_update_request (0)
key_update_response (1)
key_update_finish (2)

New ExtendedKeyUpdate message subtypes are assigned by IANA as described in . A TLS peer which receives a ExtendedKeyUpdate with an unexpected message subtype MUST abort the connection with an "unexpected_message" alert. The extended key update process can be initiated by either peer after it has sent a Finished message. Implementations that receive an ExtendedKeyUpdate message prior to the sender having sent Finished MUST terminate the connection with an "unexpected_message" alert. The KeyShareEntry carried in a key_update_request and in a key_update_response MUST use the group that was negotiated by the client and server during the initial handshake. An implementation that receives an algorithm other than previously negotiated MUST terminate the connection with an "illegal_parameter" alert. shows the interaction graphically. First, support for the functionality in this specification is negotiated in the ClientHello and the EncryptedExtensions messages. Then, the ExtendedKeyUpdate exchange is sent to update the application traffic secrets. The extended key update exchange is performed between the initiator and the responder; either the TLS client or the TLS server may act as initiator.

Extended Key Update Message Exchange in TLS 1.3. ServerHello ^ Key + key_share | Exch v {EncryptedExtensions ^ Server + extended_key_update} | Params {CertificateRequest} v {Certificate} ^ {CertificateVerify} | Auth {Finished} v <-------- ^ {Certificate} Auth | {CertificateVerify} v {Finished} --------> [Application Data]N <-------> [Application Data]N ... [EKU(key_update_request)]N --------> <-------- [EKU(key_update_response)]N [EKU(key_update_finish)]N --------> ... [Application Data]N+1 <-------> [Application Data]N+1 Legend: + Indicates noteworthy extensions sent in the previously noted message. - Indicates optional or situation-dependent messages/extensions that are not always sent. () Indicates messages protected using keys derived from a client_early_traffic_secret. {} Indicates messages protected using keys derived from a [sender]_handshake_traffic_secret. []N Indicates messages protected using keys derived from [sender]_application_traffic_secret_N. ]]> The ExtendedKeyUpdate wire format is: Fields:

eku_type: the subtype of the ExtendedKeyUpdate message.
key_share: key share information. The contents of this field is determined by the specified group and its corresponding definition (see ).

TLS 1.3 Extended Key Update Procedure The following steps are taken by a TLS 1.3 implementation; the steps executed with DTLS 1.3 differ slightly.

The initiator sends ExtendedKeyUpdate(key_update_request) carrying a KeyShareEntry. While an extended key update is in progress, the initiator MUST NOT initiate another key update.
Upon receipt, the responder sends its own KeyShareEntry in a ExtendedKeyUpdate(key_update_response) message. After receiving an ExtendedKeyUpdate(key_update_request), the responder MUST NOT send an ExtendedKeyUpdate(key_update_request) until it has received ExtendedKeyUpdate(key_update_finish). The responder MAY defer sending a response if system load or resource constraints prevent immediate processing. In such cases, the response MUST be sent once sufficient resources become available.
After the responder sends the ExtendedKeyUpdate(key_update_response) it MUST update its send keys.
Upon receipt of an ExtendedKeyUpdate(key_update_response) the initiator derives the new secrets from the exchanged key shares. The initiator then updates its receive keys and sends an empty ExtendedKeyUpdate(key_update_finish) message to complete the process. The initiator MUST NOT defer derivation of the secrets and sending the ExtendedKeyUpdate(key_update_finish) message as it would stall the communication.
After sending ExtendedKeyUpdate(key_update_finish), the initiator MUST update its send keys.
Upon receiving the initiator’s ExtendedKeyUpdate(key_update_finish), the responder MUST update its receive keys.

Both initiator and responder MUST encrypt their ExtendedKeyUpdate messages using the old keys. The Responder MUST ensure that it has received ExtendedKeyUpdate(key_update_finish), encrypted with the old key, before accepting any messages encrypted with the new keys. If TLS peers independently initiate the extended key update and the requests cross in flight, the ExtendedKeyUpdate(key_update_request) with the lower lexicographic order of the key_exchange value in KeyShareEntry MUST be ignored. It MUST NOT be included in the transcript hash. This prevents each side from advancing keys by two generations. If the tie-break comparison yields equality (an event that should be impossible for genuine asymmetric key pairs), the endpoint MUST treat this as a protocol violation, send an "unexpected_message" alert, and close the connection. The handshake framing uses a single HandshakeType for this message (see ).

TLS 1.3 Handshake Structure.

TLS 1.3 Extended Key Update Example shows the high-level interaction between a TLS 1.3 client and server, while illustrates an example message exchange including the updated keys. Similar to the key_update message, the extended_key_update message can be sent by either peer after sending its Finished message.

Extended Key Update Example. ServerHello ^ Key + key_share | Exch v {EncryptedExtensions ^ Server + extended_key_update} | Params {CertificateRequest} v {Certificate} ^ {CertificateVerify} | Auth {Finished} v <-------- ^ {Certificate} Auth | {CertificateVerify} v {Finished} --------> ... some time later ... [EKU(key_update_request --------> (with key_share))] <-------- [EKU(key_update_response (with key_share))] # Server derives new secrets # and updates SEND keys here # Client derives new secrets # and updates RECEIVE keys here [EKU(key_update_finish)] --------> # Client updates SEND keys here # Server updates RECEIVE keys here ]]>

DTLS 1.3 Extended Key Update Procedure Unlike TLS 1.3, DTLS 1.3 implementations must take into account that handshake messages are not transmitted over a reliable transport protocol. EKU messages MUST be transmitted reliably, like other DTLS handshake messages. If necessary, EKU messages MAY be fragmented as described in . Due to the possibility of an ExtendedKeyUpdate messages being lost and thereby preventing the sender of that message from updating its keying material, receivers MUST retain the pre-update keying material until receipt and successful decryption of a message using the new keys. Due to packet loss and/or reordering, DTLS 1.3 peers MAY receive records from an earlier epoch. If the necessary keys are available, implementations SHOULD attempt to process such records; however, they MAY choose to discard them. The exchange has the following steps:

The initiator sends an ExtendedKeyUpdate(key_update_request) message, which contains a key share. While an extended key update is in progress, the initiator MUST NOT initiate further key updates. This message is subject to DTLS handshake retransmission, but delivery is only confirmed when the initiator either receives the corresponding ExtendedKeyUpdate(key_update_response) or an ACK.
Upon receipt, the responder sends its own KeyShareEntry in a ExtendedKeyUpdate(key_update_response) message. After receiving an ExtendedKeyUpdate(key_update_request), the responder MUST NOT send an ExtendedKeyUpdate(key_update_request) until it has received ExtendedKeyUpdate(key_update_finish). The responder MAY defer sending a response if system load or resource constraints prevent immediate processing. In such cases, the responder MUST acknowledge receipt of the key_update_request with an ACK and, once sufficient resources become available, retransmit the key_update_response until it is acknowledged by the initiator. key_update_response and ACK message MAY be received out of order; a late ACK MUST be ignored and MUST NOT affect the extended key update state machine.
On receipt of ExtendedKeyUpdate(key_update_response) the initiator derives a secret key based on the exchanged key shares. This message also serves as an implicit acknowledgment of the initiator's ExtendedKeyUpdate(key_update_request), so no separate ACK is required. The initiator MUST update its receive keys and epoch value. The initiator MUST NOT defer derivation of the secrets.
The initiator transmits an ExtendedKeyUpdate(key_update_finish) message. This message is subject to DTLS retransmission until acknowledged.
The responder MUST acknowledge the received message by sending an ACK message.
After the responder receives the initiator's ExtendedKeyUpdate(key_update_finish), the responder MUST update its send key and epoch value. With the receipt of that message, the responder MUST also update its receive keys.
On receipt of the ACK message, the initiator updates its send key and epoch value. If this ACK is not received, the initiator re-transmits its ExtendedKeyUpdate(key_update_finish) until ACK is received. The key update is complete once this ACK is processed by the initiator.

If DTLS peers independently initiate the extended key update and the requests cross in flight, they are resolved as specified in . The handshake framing uses a single HandshakeType for this message (see ).

DTLS 1.3 Handshake Structure.

DTLS 1.3 Extended Key Update Example The following example illustrates a successful extended key update, including how the epochs change during the exchange.

Example DTLS 1.3 Extended Key Update: Message Exchange. [C: tx=3, rx=3] [S: tx=3, rx=3] [C: tx=3, rx=3] [S: tx=3, rx=3] <-------- [Application Data] [C: tx=3, rx=3] [S: tx=3, rx=3] /---------------------------------------\ | Some time later ... | \---------------------------------------/ [C: tx=3, rx=3] [S: tx=3, rx=3] [EKU(key_update_request)] --------> # no epoch change yet <-------- [EKU(key_update_response)] # Sent under OLD epoch. Server does NOT bump yet. # Step 3: initiator bumps RECEIVE epoch on # receiving key update response-in: # (rx:=rx+1; tx still old) [C: tx=3, rx=4] [S: tx=3, rx=3] [EKU(key_update_finish)] --------> # Sender's Fin is tagged with OLD tx (3). # Epoch switch point: # Step 6: responder bumps BOTH tx and rx on Fin-in: [C: tx=3, rx=4] [S: tx=4, rx=4] <-------- [ACK] (tag=new) # Step 7: initiator bumps SEND epoch on ACK-in: [C: tx=4, rx=4] [S: tx=4, rx=4] [Application Data] --------> [C: tx=4, rx=4] [S: tx=4, rx=4] <-------- [Application Data] [C: tx=4, rx=4] [S: tx=4, rx=4] ]]> shows the steps, the message in flight, and the epoch changes on both sides. The A/B -> X/Y notation indicates the change of epoch values for tx/rx before and after the message transmission.

Example DTLS 1.3 Extended Key Update: Epoch Changes. | 3/3 -> 3/3 | 3/3 -> 3/3 | | <------------ APP | 3/3 -> 3/3 | 3/3 -> 3/3 | | req -------------> | 3/3 -> 3/3 | 3/3 -> 3/3 | | <------------ resp | 3/3 -> 3/4 | 3/3 -> 3/3 | <- step 3 | Fin ------------> | 3/4 -> 3/4 | 3/3 -> 4/4 | <- step 6 | <------------- ACK | 3/4 -> 4/4 | 4/4 -> 4/4 | <- step 7 | APP -------------> | 4/4 -> 4/4 | 4/4 -> 4/4 | | <------------- APP | 4/4 -> 4/4 | 4/4 -> 4/4 | +--------------------+----------------+--------------+ ]]>

Updating Traffic Keys When the extended key update message exchange is completed both peers have successfully updated their application traffic keys. The key derivation function described in this document is used to perform this update. The design of the key derivation function for computing the next generation of application_traffic_secret is motivated by the desire to include

a secret derived from the negotiated key exchange, whether (EC)DHE, post-quantum KEM, or a PQ/T hybrid mechanism,
a secret that allows the new key exchange to be cryptographically bound to the previously established secret,
a transcript hash that is updated after each Extended Key Update exchange by hashing the previous transcript hash together with the current ExtendedKeyUpdate(key_update_request) and ExtendedKeyUpdate(key_update_response) messages. This binds any encapsulation ciphertext and public key used in PQ/T hybrid or post-quantum key exchanges to the input keying material (IKM) and cryptographically binds the newly derived secrets to the original handshake transcript, all prior EKU exchanges, the current EKU exchange, and the corresponding KEM public key and encapsulation ciphertext, and
new label strings to distinguish it from the key derivation used in TLS 1.3.

The transcript_hash_N denotes the transcript hash value associated with generation N. transcript_hash_0 is Transcript-Hash(ClientHello..client Finished) of the initial handshake. During each Extended Key Update exchange, transcript_hash_N+1 is computed over the concatenation of transcript_hash_N, the ExtendedKeyUpdate(key_update_request) handshake message, and the ExtendedKeyUpdate(key_update_response) handshake message, with handshake messages encoded as specified in for TLS and for DTLS: Once transcript_hash_N+1 has been computed, transcript_hash_N can be deleted. No prior transcript hash values need to be retained for future EKU exchanges. main_secret_N denotes the Main Secret (see ) associated with generation N. shows the key derivation hierarchy.

Key Derivation Hierarchy. HKDF-Extract = main_secret_N+1 | +-----> Derive-Secret(., "c ap traffic", | transcript_hash_N+1) | = client_application_traffic_secret_N+1 | +-----> Derive-Secret(., "s ap traffic", | transcript_hash_N+1) | = server_application_traffic_secret_N+1 | +-----> Derive-Secret(., "exp master", | transcript_hash_N+1) | = exporter_secret_N+1 ]]> During the initial handshake, the Main Secret is generated (see ). Since the main_secret is discarded during the key derivation procedure, a derived value is stored. This stored value then serves as the input salt to the first key update procedure that incorporates the shared secret as IKM to produce main_secret_N+1. The derived value from this new main secret serves as input salt to the subsequent key update procedure, which also incorporates a fresh shared secret as IKM. This process is repeated for each additional key update procedure. The shared secret is determined by the negotiated key exchange mechanism. In the base protocol, this mechanism is (EC)DHE (see ). Post-quantum and hybrid key exchange mechanisms derive the shared secret as specified by their respective definitions. See also . The traffic keys are re-derived from client_application_traffic_secret_N+1 and server_application_traffic_secret_N+1, as described in . Once client_/server_application_traffic_secret_N+1 and its associated traffic keys have been computed, implementations SHOULD delete client_/server_application_traffic_secret_N and its associated traffic keys as soon as possible. Note: The client_/server_application_traffic_secret_N and its associated traffic keys can only be deleted by the responder after receiving the ExtendedKeyUpdate(key_update_finish) message. Once client_/server_application_traffic_secret_N+1 and the corresponding traffic keys are in use, all subsequent records, including alerts and post-handshake messages MUST be protected using those keys.

Resumption EKU provides post-compromise recovery for the TLS connection in which it is performed. The recovery guarantees depend on the threat model in . In typical deployment environments, PSKs established via the NewSessionTicket mechanism are generated and reside in endpoint memory. Although such PSKs may subsequently be stored in secure storage, they are exposed during this initial processing window, and compromise of endpoint memory during this period is sufficient to reveal them. Consequently, later protection using secure storage does not prevent their prior compromise. These PSKs are sufficient to establish new authenticated TLS connections. Even if an implementation invalidates previously issued PSKs upon completion of the EKU exchange, an attacker that has already obtained such a PSK may initiate and complete a resumed session prior to that invalidation. In such environments, EKU does not prevent the use of previously issued PSKs. Accordingly, endpoints that enable EKU MUST disable resumption using PSKs established via the NewSessionTicket mechanism. resumption_main_secret_N+1 is not derived for this reason in .

Post-Quantum Cryptography Considerations The shared secret used by the Extended Key Update mechanism is derived according to the negotiated key exchange method. As a result, this specification supports the same classes of key establishment mechanisms as TLS itself, including traditional Diffie-Hellman-based key exchanges, post-quantum key encapsulation mechanisms (KEMs), and hybrid combinations thereof. In the base TLS protocol, the shared secret is typically established using (EC)DHE (see ). Recent extensions have introduced support for post-quantum and hybrid key establishment mechanisms to facilitate the transition to post-quantum cryptography. The rationale for this transition and the associated terminology are discussed in and , respectively. For hybrid mechanisms such as SecP256r1MLKEM768, defined in , the shared secret is derived by combining the outputs of the constituent algorithms; specifically, it is the concatenation of the ECDHE and ML-KEM shared secrets. For ML-KEM-only key exchange, as defined in , the ML-KEM shared secret is provided directly to the TLS key schedule in place of the (EC)DHE shared secret. The Extended Key Update protocol reuses the key exchange representation defined by the negotiated mechanism. Consequently, the exchange of fresh key shares during an Extended Key Update follows the same encoding and shared-secret derivation rules as the corresponding TLS handshake. For KEMs, the initiator generates the encapsulation key and the responder performs encapsulation against it, regardless of which peer acted as the TLS client or server during the initial handshake.

SSLKEYLOGFILE Update As a successful extended key update exchange invalidates previous secrets, SSLKEYLOGFILE needs to be populated with new entries. As a result, three additional secret labels are utilized in the SSLKEYLOGFILE:

CLIENT_TRAFFIC_SECRET_N+1: identifies the client_application_traffic_secret_N+1 in the key schedule
SERVER_TRAFFIC_SECRET_N+1: identifies the server_application_traffic_secret_N+1 in the key schedule
EXPORTER_SECRET_N+1: identifies the exporter_secret_N+1 in the key schedule

Similar to other entries in the SSLKEYLOGFILE, the label is followed by the 32-byte value of the Random field from the ClientHello message that established the TLS connection, and the corresponding secret encoded in hexadecimal. SSLKEYLOGFILE entries for the extended key update MUST NOT be produced if SSLKEYLOGFILE was not used for other secrets in the handshake. Note that each successful Extended Key Update invalidates all previous SSLKEYLOGFILE secrets including past iterations of CLIENT_TRAFFIC_SECRET_, SERVER_TRAFFIC_SECRET_ and EXPORTER_SECRET_.

Exporter

Post-Compromise Security for the Initial Exporter Secret The TLS 1.3 Key Schedule, see Figure 5 of , derives the exporter_secret from the main secret. This exporter_secret is static for the lifetime of the connection and is not updated by a standard key update. A core design goal of this specification is not met if the exporter_secret does not change. Therefore, this document defines an exporter interface that derives a fresh exporter secret whenever new application traffic keys are updated through the EKU. If the initial exporter secret for this new interface were identical to exporter_secret, then compromising exporter_secret at any point during the lifetime of the connection would enable an attacker to recompute all exporter outputs derived from it. This would break post-compromise security for exported keying material. Therefore, the initial exporter secret used by the exporter interface defined in this document, i.e., the exporter output available prior to the first Extended Key Update, MUST be distinct from the exporter_secret. This separation ensures that compromise of the TLS exporter interface does not compromise outputs derived from the exporter interface defined in this document. Prior to the first Extended Key Update, the exporter interface provides an initial exporter secret, denoted exporter_secret_0. This secret is derived from the TLS main secret and the handshake transcript, but is cryptographically independent of the TLS exporter_secret. It is computed as follows: Applications that require post-compromise security MUST use the exporter interface defined in this document. This exporter interface is independent of the TLS exporter defined in , which continues to use a static exporter_secret for the lifetime of the connection for compatiblity with "legacy" applications.

Exporter Usage After Extended Key Update Protocols such as DTLS-SRTP and DTLS-over-SCTP rely on TLS or DTLS for key establishment, but reuse portions of the derived keying material for their own specific purposes. These protocols use the TLS exporter defined in . Exporters are also used for deriving authentication related values such as nonces, as described in . Once the Extended Key Update mechanism is complete, such protocols would need to use the newly derived exporter secret to generate Exported Keying Material (EKM) to protect packets. The exporter_secret_N+1 derived in will be used as the "Secret" in the exporter function, defined in , to generate EKM, ensuring that the exported keying material is aligned with the updated security context. Compromise of a previous exporter secret does not suffice to derive exporter_secret_N+1. When a new exporter secret becomes active following a successful Extended Key Update, the TLS or DTLS implementation would have to provide an asynchronous notification to the application indicating that:

A new generation has become active, and the (D)TLS implementation MUST include the corresponding generation N, where exporter_secret_N is the exporter secret of that generation. Generation 0 corresponds to exporter_secret_0, and each successful Extended Key Update increments N by one, so both peers associate the same generation with the same exporter secret. Applications use the generation to request keying material through a generation-aware exporter interface, so a subsequent Extended Key Update does not change the result.

Applications are notified that a new generation is active only after the endpoint has completed the Extended Key Update exchange and switched to the new traffic keys.

In TLS, the initiator triggers notification after Step 5 in , and the responder triggers notification after Step 6 in .
In DTLS, the initiator triggers notification to the application after Step 7 in , and the responder triggers notification after Step 6 in .

The corresponding EKM is obtained by the application through the generation-aware exporter interface using the generation and its chosen label and context values as defined in . The application conveys the generation it used to the peer, for example with the protected data, so that the peer derives the same EKM. To prevent desynchronization, the application will have to retain both the previous and the newly derived exporter secrets for a short period. For TLS, the previous exporter secret would be discarded once data derived from the new exporter has been successfully processed, and no records protected with the old exporter secret are expected to arrive. For DTLS, the previous exporter secret needs to be retained until the retention timer expires for the prior epoch, to allow for processing of packets that may arrive out of order. The retention policy for exporter secrets is application-specific. For example, in DTLS-SRTP, the application might retain the previous exporter secret until its replay window no longer accepts packets protected with keys derived from that secret, as described in Section 3.3.2 of .

Use of Post-Handshake Authentication and Exported Authenticators with Extended Key Update EKU provides fresh traffic secrets, but after compromise of the connection state described in , EKU alone does not authenticate the exchange. An attacker that retains this state, including the value used to derive main_secret_N+1, can act as a person-in-the-middle during the exchange, cause the peers to derive divergent traffic secrets, and learn the new keys. TLS 1.3 provides two mechanisms that can detect such divergence, each with a different scope. Post-Handshake Certificate-Based Client Authentication () only authenticates the client to the server, and therefore allows only the server to detect divergence. Exported Authenticators authenticate the endpoint that produces the authenticator, so detection at both endpoints requires an authenticator in each direction.

Post-Handshake Certificate-Based Client Authentication When Post-Handshake Certificate-Based Client Authentication () is performed after an Extended Key Update (EKU) is complete, the Handshake Context used for the transcript hash is updated. It consists of transcript_hash_N+1 concatenated with the CertificateRequest message. Both endpoints use the Handshake Context in effect when the CertificateRequest is sent. The Finished message is computed using a MAC key derived from the Base Key of the new generation (client_application_traffic_secret_N+1). Because the CertificateVerify message is signed with the private key corresponding to the client's end-entity certificate over this Handshake Context, the server can detect divergent key state. Post-Handshake Certificate-Based Client Authentication does not reauthenticate the server, so the client gains no equivalent assurance. A client that requires such assurance can request an Exported Authenticator from the server.

Exported Authenticators This document updates Section 5.1 of to specify that, after an Extended Key Update has completed, the Handshake Context and Finished MAC Key used for Exported Authenticators MUST be derived from the exporter secret of the current generation. Implementations that support the generation-aware Exported Authenticators interface MUST provide a means for applications to request the creation or validation of Exported Authenticators using the exporter secret of a specific generation. The Handshake Context and Finished MAC Key used in both the CertificateVerify message (Section 5.2.2 of ) and the Finished message (Section 5.2.3 of ) are derived from the exporter secret of the current generation. If a person-in-the-middle attacker interferes with the EKU exchange, the peers derive different exporter secrets. Validation as specified in Section 5.2.4 of then fails at the endpoint that receives the authenticator, since the CertificateVerify message is signed with a private key the attacker does not hold. A new optional API SHOULD be defined to permit applications to request or verify Exported Authenticators for a specific generation. As discussed in Section 7 of , this can, as an exception, be implemented at the application layer when the generation-aware TLS exporter is available. The APIs defined in remain unchanged, so existing applications continue to operate without modification. The generation-aware API accepts a generation; when present, the (D)TLS implementation MUST derive the Handshake Context and Finished MAC Key from the exporter secret of that generation. When Exported Authenticators are generated using the generation-aware Exported Authenticators interface, the generation used for their derivation can be conveyed in the certificate_request_context field, allowing the peer, particularly in DTLS where records may be reordered, to determine the correct exporter secret for validation.

Interaction of Extended Key Update and Post-Handshake Authentication EKU and Post-Handshake Authentication may both occur during the lifetime of a (D)TLS connection. Post-Handshake Certificate-Based Client Authentication (PHA) is bound to the handshake transcript and computes its Finished message as specified in , using a key derived from the application traffic secret that is active at the time the CertificateRequest is sent. Therefore, specific ordering constraints are required to preserve cryptographic consistency.

Post-Handshake Certificate-Based Client Authentication An endpoint MUST NOT complete an EKU exchange in a manner that transitions to new application traffic secrets while a PHA exchange is in progress. The following constraints apply to both TLS 1.3 and DTLS 1.3:

An endpoint MUST NOT initiate PHA while an EKU exchange is in progress.
If PHA has been initiated and the corresponding authentication exchange has not yet completed, neither endpoint MUST initiate an EKU exchange.
In a cross-flight condition, if a (D)TLS client sends an EKU request and, before receiving a response, receives a CertificateRequest from the (D)TLS server, the endpoints MUST defer completion of the EKU exchange and proceed with the Post-Handshake Authentication exchange. The endpoints MUST NOT transition to new application traffic secrets until the authentication exchange has completed.

In DTLS, deferred EKU request is acknowledged as specified in .

Exported Authenticators Because the exporter interface defined in this document is generation-aware, the exporter secret used for an Exported Authenticator exchange is explicitly determined by the generation selected by the application. As a result, cross-flight exchanges of EKU and AuthenticatorRequest messages do not introduce cryptographic ambiguity. Therefore, no serialization requirement is imposed between EKU and Exported Authenticator exchanges.

Deployment Considerations Extended Key Update is enabled by explicit configuration, either by an operator for all applications on a device or by an application that needs it. The configuration includes a policy for when to initiate an Extended Key Update, for example at a fixed interval or after a certain amount of data has been exchanged. When enabled by an operator, the application may not be aware of Extended Key Update. Enabling it has the following effects:

Resumption using PSKs established via the NewSessionTicket mechanism is disabled ().
Applications that use exported keying material and require post-compromise security use the exporter interface defined in .
Post-Handshake Certificate-Based Client Authentication and Exported Authenticators performed after an Extended Key Update are bound to the updated keys ().

Implementations can warn when the exporter defined in is used on a connection where Extended Key Update was negotiated.

Security Considerations This section discusses additional security and operational aspects introduced by the Extended Key Update mechanism. All security considerations of TLS 1.3 and DTLS 1.3 continue to apply.

Threat Model The specification assumes that the adversary has the following capabilities:

Network attacker: The adversary has full control over the network between the endpoints. It can read, modify, inject, drop, delay, and reorder messages, including EKU messages. This is the same attacker model assumed by TLS 1.3 (see ).
Transient endpoint compromise: For a limited period of time, the adversary can read the memory of one or both endpoints. During this period it obtains all keying material held by that endpoint for the connection, including the current application traffic secrets and keys, the exporter secrets, the value retained for deriving main_secret_N+1, transcript_hash_N, and any ephemeral key exchange material in use. After the compromise ends, the adversary retains all keying material obtained but has no access to ephemeral key exchange material generated afterwards.

The security guarantees of Extended Key Update depend on the time of compromise and the adversary's subsequent actions:

If compromise ends before an Extended Key Update starts, and the adversary does not interfere with the exchange, then the adversary cannot derive the traffic keys and exporter secrets established by that Extended Key Update.
If the adversary uses keying material obtained during the compromise to act as a person-in-the-middle attacker during an Extended Key Update, then security cannot be restored. Such interference is detected by the endpoint that validates the peer's authentication using a mechanism described in .

The following are out of scope:

An adversary with ongoing access to keying material on an endpoint, also called a persistent adversary.
Compromise of a long-term private key. An adversary holding it can impersonate that endpoint in future TLS connections. The detection guarantees in rely on the corresponding private key remaining secure.

If a compromise occurs before the handshake completes, the ephemeral key exchange, client_handshake_traffic_secret, server_handshake_traffic_secret, and the initial client_/server_application_traffic_secret could be exposed. Recovery then depends on the conditions stated above.

Post-Compromise Security Under the threat model described in , Extended Key Update provides post-compromise security for long-lived TLS sessions. To ensure post-compromise security guarantees each update MUST use freshly generated ephemeral key exchange material. Implementations MUST NOT reuse ephemeral key exchange material across updates or across TLS sessions.

Denial-of-Service (DoS) The Extended Key Update mechanism increases computational and state-management overhead. A malicious peer could attempt to exhaust CPU or memory resources by initiating excessive update requests. Implementations SHOULD apply the following mitigations:

Limit the frequency of accepted Extended Key Update requests per session.
A peer that has sent an Extended Key Update MUST NOT initiate another until the previous update completes. If a peer violates this rule, the receiving peer MUST treat it as a protocol violation, send an "unexpected_message" alert, and terminate the connection.

Operational Guidance Deployments SHOULD evaluate Extended Key Update performance under load and fault conditions, such as high-frequency or concurrent updates. TLS policies SHOULD define explicit rate limits that balance post-compromise security benefits against potential DoS exposure.

IANA Considerations

TLS Flags IANA is requested to add the following entry to the "TLS Flags" extension registry :

Value: TBD1
Flag Name: extended_key_update
Messages: CH, EE
Recommended: Y
Reference: This document

TLS HandshakeType IANA is requested to add the following entry to the "TLS HandshakeType" registry :

Value: TBD2
Description: extended_key_update
DTLS-OK: Y
Reference: This document

ExtendedKeyUpdate Message Subtypes Registry IANA is requested to create a new registry "TLS ExtendedKeyUpdate Message Subtypes", within the existing "Transport Layer Security (TLS) Parameters" registry group . This new registry reserves types used for Extended Key Update entries. The initial contents of this registry are as follows.

Value	Description	DTLS-OK	Reference
0	key_update_request	Y	This document
1	key_update_response	Y	This document
2	key_update_finish	Y	This document
3-255	Unassigned

New assignments in the "TLS ExtendedKeyUpdate Message Subtypes" registry will be administered by IANA through Specification Required procedure . The role of the designated expert is described in . The designated expert ensures that the specification is publicly available. It is sufficient to have an Internet-Draft (that is posted and never published as an RFC) or to cite a document from another standards body, industry consortium, or any other location. An expert may provide more in-depth reviews, but their approval should not be taken as an endorsement of the ExtendedKeyUpdate Message Subtype.

SSLKEYLOGFILE labels IANA is requested to add the following entries to the "TLS SSLKEYLOGFILE Labels" extension registry :

Value	Description	Reference	Comment
CLIENT_TRAFFIC_SECRET_N+1	Secret protecting client records after Extended Key Update	This document	N represents iteration of Extended Key Update
SERVER_TRAFFIC_SECRET_N+1	Secret protecting server records after Extended Key Update	This document	N represents iteration of Extended Key Update
EXPORTER_SECRET_N+1	Exporter secret after Extended Key Update	This document	N represents iteration of Extended Key Update

References Normative References The Transport Layer Security (TLS) Protocol Version 1.3 This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document obsoletes RFC 8446, which specified TLS 1.3. This document obsoletes RFC 5246 (specifying TLS 1.2) and RFCs 5077, 6961, 7627, and 8422, all of which pertain to TLS 1.2 or earlier, and updates RFCs 5705 and 6066. This document also specifies new requirements for TLS 1.2 implementations. The Datagram Transport Layer Security (DTLS) Protocol Version 1.3 This document specifies version 1.3 of the Datagram Transport Layer Security (DTLS) protocol. DTLS 1.3 allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. The DTLS 1.3 protocol is based on the Transport Layer Security (TLS) 1.3 protocol and provides equivalent security guarantees with the exception of order protection / non-replayability. Datagram semantics of the underlying transport are preserved by the DTLS protocol. This document obsoletes RFC 6347. Key words for use in RFCs to Indicate Requirement Levels In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. A Flags Extension for TLS 1.3 Dell Technologies A number of extensions are proposed in the TLS working group that carry no interesting information except the 1-bit indication that a certain optional feature is supported. Such extensions take 4 octets each. This document defines a flags extension that can provide such indications at an average marginal cost of 1 bit each. More precisely, it provides as many flag extensions as needed at 4 + the order of the last set bit divided by 8. The Concealed HTTP Authentication Scheme Most HTTP authentication schemes are probeable in the sense that it is possible for an unauthenticated client to probe whether an origin serves resources that require authentication. It is possible for an origin to hide the fact that it requires authentication by not generating Unauthorized status codes; however, that only works with non-cryptographic authentication schemes: cryptographic signatures require a fresh nonce to be signed. Prior to this document, there was no existing way for the origin to share such a nonce without exposing the fact that it serves resources that require authentication. This document defines a new non-probeable cryptographic authentication scheme. The Secure Real-time Transport Protocol (SRTP) This document describes the Secure Real-time Transport Protocol (SRTP), a profile of the Real-time Transport Protocol (RTP), which can provide confidentiality, message authentication, and replay protection to the RTP traffic and to the control traffic for RTP, the Real-time Transport Control Protocol (RTCP). [STANDARDS-TRACK] Exported Authenticators in TLS This document describes a mechanism that builds on Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS) and enables peers to provide proof of ownership of an identity, such as an X.509 certificate. This proof can be exported by one peer, transmitted out of band to the other peer, and verified by the receiving peer. Informative References Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 PQShield AWS Cloudflare University of Waterloo This draft defines three hybrid key agreement mechanisms for TLS 1.3 - X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 - that combine the post-quantum ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) with an ECDHE (Elliptic Curve Diffie- Hellman) exchange. ML-KEM Post-Quantum Key Agreement for TLS 1.3 Selkie Cryptography This memo defines ML-KEM-512, ML-KEM-768, and ML-KEM-1024 as NamedGroups and registers IANA values in the TLS Supported Groups registry for use in TLS 1.3 to achieve post-quantum (PQ) key establishment. Post-Quantum Cryptography for Engineers The advent of a cryptographically relevant quantum computer (CRQC) would render state-of-the-art, traditional public key algorithms deployed today obsolete, as the mathematical assumptions underpinning their security would no longer hold. To address this, protocols and infrastructure must transition to post-quantum algorithms, which are designed to resist both traditional and quantum attacks. This document explains why engineers need to be aware of and understand post-quantum cryptography (PQC), and it details the impact of CRQCs on existing systems and the challenges involved in transitioning to post-quantum algorithms. Unlike previous cryptographic updates, this shift may require significant protocol redesign due to the unique properties of post-quantum algorithms. Recommendations for securing networks with IPsec, Technical Report ANSSI Transport Layer Security (TLS) Extensions IANA Transport Layer Security (TLS) Parameters IANA On Post-compromise Security IEEE Transport Layer Security (TLS) Renegotiation Indication Extension Secure Socket Layer (SSL) and Transport Layer Security (TLS) renegotiation are vulnerable to an attack in which the attacker forms a TLS connection with the target server, injects content of his choice, and then splices in a new TLS connection from a client. The server treats the client's initial TLS handshake as a renegotiation and thus believes that the initial data transmitted by the attacker is from the same entity as the subsequent client data. This specification defines a TLS extension to cryptographically tie renegotiations to the TLS connections they are being performed over, thus preventing this attack. [STANDARDS-TRACK] Confidentiality in the Face of Pervasive Surveillance: A Threat Model and Problem Statement Since the initial revelations of pervasive surveillance in 2013, several classes of attacks on Internet communications have been discovered. In this document, we develop a threat model that describes these attacks on Internet confidentiality. We assume an attacker that is interested in undetected, indiscriminate eavesdropping. The threat model is based on published, verified attacks. Terminology for Post-Quantum Traditional Hybrid Schemes One aspect of the transition to post-quantum algorithms in cryptographic protocols is the development of hybrid schemes that incorporate both post-quantum and traditional asymmetric algorithms. This document defines terminology for such schemes. It is intended to be used as a reference and, hopefully, to ensure consistency and clarity across different protocols, standards, and organisations. The SSLKEYLOGFILE Format for TLS Mozilla Zscaler University of Applied Sciences Bonn-Rhein-Sieg A format that supports logging information about the secrets used in a TLS connection is described. Recording secrets to a file in SSLKEYLOGFILE format allows diagnostic and logging tools that use this file to decrypt messages exchanged by TLS endpoints. This format is intended for use in systems where TLS only protects test data. Guidelines for Writing an IANA Considerations Section in RFCs Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. IANA Registry Updates for TLS and DTLS This document describes a number of changes to TLS and DTLS IANA registries that range from adding notes to the registry all the way to changing the registration policy. These changes were mostly motivated by WG review of the TLS- and DTLS-related registries undertaken as part of the TLS 1.3 development process. This document updates the following RFCs: 3749, 5077, 4680, 5246, 5705, 5878, 6520, and 7301.

Acknowledgments We would like to thank the members of the "TSVWG DTLS for SCTP Requirements Design Team" for their discussion. The members, in no particular order, were: Marcelo Ricardo Leitner, Xin Long, John Mattsson, Claudio Porfiri, Bertrand Rault, K Tirumaleswar Reddy, Zaheduzzaman Sarker, Hannes Tschofenig, Michael Tüxen, and Magnus Westerlund. Additionally, we would like to thank the chairs of the Transport and Services Working Group (tsvwg) Gorry Fairhurst and Marten Seemann as well as the responsible area director Martin Duke. Finally, we would like to thank David Benjamin, Joe Birr-Pixton, Matthijs van Duin, Scott Fluhrer, Dennis Jackson, Benjamin Kaduk, Ilari Liusvaara, Eric Rescorla, Rifaat Shekh-Yusef, Martin Thomson, Nik Stuckenbrock, Mathy Vanhoef, and Thom Wiggers for their review comments and contributions.

State Machines The sections below describe the state machines for the extended key update operation for TLS 1.3 and DTLS 1.3. The state machine diagrams in the Appendix are provided for illustrative purposes only to aid understanding of the protocol flow. They are not normative. In case of any discrepancy between the Appendix diagrams and the protocol behavior specified in the main body of this document, the text in the draft takes precedence. For editorial reasons we abbreviate the protocol message types:

Req - ExtendedKeyUpdate(request)
Resp - ExtendedKeyUpdate(response)
Fin - ExtendedKeyUpdate(key_update_finish)
ACK - Acknowledgement message from
APP - application data payloads

In the (D)TLS 1.3 state machines discussed below, the terms SEND and RECEIVE keys refer to the send and receive key variables defined in . The TLS state machine diagrams use the following notation:

Numbered labels (1), (2), … denote normal protocol transitions in the order they occur.
Lettered labels (A), (B), … denote exceptional or conditional transitions.
Self-loops indicate that the state does not change as a result of the event.

TLS 1.3 State Machines This section describes the initiator and responder state machines.

Fin message is sent under old keys.
If a standard KeyUpdate arrives (EKU negotiated), ABORT "unexpected_message".
Crossed-requests: ignore the request with LOWER lexicographic key_exchange; if equal, abort.

Responder may defer Resp under load (no status reply), then must send it once resources are free.
If a standard KeyUpdate arrives (EKU negotiated), ABORT "unexpected_message".

DTLS 1.3 State Machines This section describes the initiator and responder state machines.

Terms and Abbreviations The following variables and abbreviations are used in the state machine diagrams.

rx - current, accepted receive epoch.
tx - current transmit epoch used for tagging outgoing messages.
E - initial epoch value.
updating - true while a key-update handshake is in progress.
old_rx - the previous receive epoch remembered during retention.
retain_old - when true, receiver accepts tags old_rx and rx.
tag=... - the TX-epoch value written on an outgoing message.
e==... - the epoch tag carried on an incoming message (what the peer sent).
FINISHED / START / WAIT_RESP / WAIT_I_FIN / WAIT_R_FIN / ACTIVATE RETENTION / RESPOND / WAIT_ACK - diagram states; FINISHED denotes the steady state after success.

Crossed requests. If both peers independently initiate the extended key update and the key_update_request messages cross in flight, compare the KeyShareEntry.key_exchange values. The request with the lower lexicographic value must be ignored. If the values are equal, the endpoint must abort with an "unexpected_message" alert. If the peer's value is higher than the local one, the endpoint abandons its in-flight update and processes the peer's request as responder.

State Machine (Initiator) The initiator starts in the START state with matching epochs (rx := E; tx := E). It sends a Req and enters WAIT_RESP (updating := 1). While waiting, APP data may be sent at any time (tagged with the current tx) and received according to the APP acceptance rule below. Once the responder returns Resp with a tag matching the current rx, the initiator derives new key material. It then sends Fin still tagged with the old tx. The initiator activates retention mode: the old epoch is remembered, the receive epoch is incremented, and application data is accepted under both epochs for a transition period. Initiator moves to WAIT_ACK. If a peer key_update_request arrives while in WAIT_RESP (crossed updates), apply the crossed-request rule above. If the peer's key_exchange is higher, abandon the local update (updating := 0) and continue as responder: send key_update_response, derive new secrets, then proceed with the responder flow. If lower, ignore the peer's request; if equal, abort with "unexpected_message". Upon receiving the responder's ACK matching the updated epoch, the initiator completes the transition by synchronizing transmit and receive epochs (tx := rx), disabling retention, and clearing the update flag. The state machine returns to FINISHED, ready for subsequent updates. Throughout the process:

Duplicate messages are tolerated (for retransmission handling).
Temporary epoch mismatches are permitted while an update is in progress.
Application data flows continuously, subject to epoch acceptance rules.

State Machine (Responder) The responder starts in the START state with synchronized transmit and receive epochs (rx := E; tx := E) and no update in progress. Application data can be transmitted at any time using the sender's current transmit epoch. A receiver must accept application data if the epoch tag on the DTLS record equals the receiver's current receive epoch. If the receiver has retention active (retain_old == true), the receiver must also accept DTLS records whose epoch tag equals the remembered previous epoch. Upon receiving an ExtendedKeyUpdate(key_update_request) (Req), the responder transitions to RESPOND. The responder may defer sending ExtendedKeyUpdate(key_update_response) under load; in that case it must acknowledge the request with an ACK and retransmit the response until it is acknowledged by the initiator, as specified in DTLS considerations. When sent, ExtendedKeyUpdate(key_update_response) is tagged with the current tx. After an ExtendedKeyUpdate(key_update_finish) (Fin) is received with the correct epoch, the responder:

activates retention (old_rx := rx; retain_old := 1),
increments both epochs (rx++, tx++),
sends ACK tagged with the new tx (which now equals the new rx),
clears updating and enters FINISHED.

Retention at the responder ends automatically on the first APP received under the new rx (then retain_old := 0). APP traffic is otherwise permitted at any time; reordering is tolerated by the acceptance rule. APP acceptance rule (receiver): accept if e == rx or (retain_old && e == old_rx). If retain_old is set and an APP with the new rx arrives, clear retain_old.

Overview of Security Goals A complete security analysis of the EKU is outside the scope of this document. This appendix provides an informal description of the primary security goals that EKU is designed to achieve.

Post-Compromise Security (PCS) Extended Key Update provides post-compromise security under the conditions and with the guarantees stated in . This property follows from the use of fresh ephemeral key exchange material during each Extended Key Update.

Key Freshness and Cryptographic Independence Each Extended Key Update derives new traffic keys from ephemeral key exchange material. This ensures strong separation between successive traffic keys:

Compromise of prior traffic keys does not suffice to derive the new traffic keys established by an Extended Key Update.
Compromise of one of traffic keys does not allow recovery of any earlier or later traffic keys.
Application data protected under one of the traffic keys cannot be decrypted using keys from another.

Elimination of Standard KeyUpdate Once Extended Key Update has been negotiated for a session, peers rely exclusively on EKU rather than the standard TLS 1.3 KeyUpdate mechanism. Relying solely on Extended Key Update helps maintain PCS properties throughout the lifetime of the TLS session.

Detecting Divergent Key State As described in , Post-Handshake Certificate-Based Client Authentication and Exported Authenticators can be used after an Extended Key Update to detect that the endpoints derived different keys. Detection relies on the CertificateVerify message, which is signed with a private key the attacker does not hold, so validation fails and the interference is revealed. If validation of a Post-Handshake Certificate-Based Client Authentication CertificateVerify or Finished message fails, the server terminates the connection with a "decrypt_error" alert (see and ). The client is not guaranteed to receive this alert, since a person-in-the-middle attacker can drop it. For Exported Authenticators, the validation result is returned to the application (see Section 7.4 of ), which decides how to react. Detection at both endpoints requires an authenticator from each endpoint, as described in .