Method SSL.State()->check_aead_usage_limit()

class SSL.State

Method check_aead_usage_limit

int(0..2) check_aead_usage_limit()

Description

TLS 1.3 and later (RFC 9846 section 5.5): check whether this State's AEAD key is approaching, or has reached, its safe usage limit (a MUST since RFC 9846, previously only a SHOULD in RFC 8446) -- call periodically from both Connection.to_write() (this State's own usage) and Connection.recv_packet() (the peer's).

Returns

AEAD_LIMIT_rekey the first time next_seq_num crosses a conservative threshold below the real limit (giving a key update time to complete before the hard limit is ever reached); AEAD_LIMIT_close the first time it reaches the hard limit itself (meaning no rekey happened in time); AEAD_LIMIT_none otherwise. Each of the first two fires at most once per object.

Note

RFC 9846 5.5 gives an explicit limit only for AES-GCM (~2^24.5 records); ChaCha20-Poly1305 has no limit of this kind short of the 64-bit sequence number itself (unreachable in practice). AES-CCM is given no limit of its own either -- this conservatively applies the same AES-GCM figure to it too, rather than assume an unbounded one.