Clarify discarding keys

tlswg · Jun 14, 2024 · 42f72b6 · 42f72b6
1 parent 3886fd2
commit 42f72b6
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/draft-tschofenig-tls-extended-key-update.md b/draft-tschofenig-tls-extended-key-update.md
@@ -333,7 +333,9 @@ in the generation of the application traffic secret.
 Once client_/server_application_traffic_secret_N+1 and its associated
 traffic keys have been computed, implementations SHOULD delete
 client_/server_application_traffic_secret_N and its associated
-traffic keys.
+traffic keys. Note: The client_/server_application_traffic_secret_N and
+its associated traffic keys can only be deleted after receiving the
+NewKeyUpdate message.
 
 # Example