Move traffic key initialization to match draft-11

Move traffic key initialization to match draft-11

[ekr-rietveld, 2016-02-11 17:30:08]

MT, this got changed between draft-10 and draft-11 but we missed it in the
draft-11 update. Caught during interop testing with Karthik

[mt, 2016-02-11 23:05:47]

Patch set 1 LGTM

https://codereview.appspot.com/285470043/diff/1/lib/ssl/tls13con.c
File lib/ssl/tls13con.c (right):

https://codereview.appspot.com/285470043/diff/1/lib/ssl/tls13con.c#newcode1642
lib/ssl/tls13con.c:1642: FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE,
internal_error);
You have a fatal error here, but none of the other call sites.  If this is worth
having a fatal error for (I think that it is), then you should move this to
InstallCipherSpec (after releasing the lock, I guess).

[ekr-rietveld, 2016-02-14 17:51:23]

Actually, I think that we should only send alerts when switching the read
cipher. My reasoning here is that at the point when you switch the write cipher
the other side is expecting the next packet to be with that cipher and so if you
can't switch, your alert won't be readable. See attached.

[mt, 2016-02-14 20:38:48]

Patch set 2 LGTM

I'd not have worried so much about whether the alert is readable as a
precondition for sending it, but you are right that it's a waste.

[mt, 2016-02-15 01:58:34]

On 2016/02/14 20:38:48, mt wrote:
> Patch set 2 LGTM

Make that Patch set 3