Re: [Masque] Encrypting between client and proxy

[Ben Schwartz <[e-mail]>]

On Tue, Nov 15, 2022 at 6:44 PM Martin Thomson <[e-mail]> wrote:
...

> The protected payload is high entropy, being comprised of ciphertext and
> is anywhere from 20 to 65506 bytes.  This payload can be split into two,
> with a 12 byte sample being used as a nonce for AES-CTR.  The remainder of
> the payload, plus part of the first byte, could then be protecting using
> AES-CTR.  The remaining 8+ bytes could again be sampled again as a nonce to
> protect the first sample.
>

The thing you are looking for is called a Pseudo-Random Permutation [1].  I
would encourage you to use HCTR2 [2].  (I learned a bit about these while
working on [3].)

[1] https://en.wikipedia.org/wiki/Pseudorandom_permutation
[2] https://github.com/google/hctr2
[3] https://datatracker.ietf.org/doc/draft-cpbs-pseudorandom-ctls/

...

> [1] A few people have noted that timing tends to be a dead giveaway here,
> as does packet size.  I have some ideas about how that might be managed,
> but let's start with the basics.
>

Personally, I think this is probably fatal, so the encryption is not really
buying you anything.   However, I would still support adding encryption
here, at least optionally, for the sake of making the attacker's job a bit
harder.  It's not the easiest thing to specify in a threat model, but there
is a real difference between "instant undeniable confirmation" and "strong
statistical inference" for an attacker.

...