Re: [Masque] Design team PR for QUIC-aware forwarding

[Christian Huitema <[e-mail]>]

On 1/25/2024 10:06 PM, Martin Thomson wrote:
> On Fri, Jan 26, 2024, at 14:53, Christian Huitema wrote:
>> Dumb question, because I suspect I am reading it wrong. Reading the PR,
>> you propose using ECB to reencrypt packets between client and server.
>> How can you use ECB and no padding if the payloadlength is not a
>> multiple of 16?
> 
> All except the 16 bytes after the connection are encrypted with CTR mode, using an IV taken from those 16 bytes.
> 
> The 16 bytes are then encrypted using ECB.
> 
> Does that help?

Yes, thank you. That's the part I missed when reading the draft. I was 
right to suspect that I was wrong.

I hear the argument that some proxies will not have the processing power 
for the double encryption required by tunnel mode, but doesn't forwarded 
mode with scrambled transform also requires double encryption? Do we 
have some measurements comparing the CPU cost of tunneled mode and 
scrambled transform? Would these measurement change if hardware 
acceleration was available for QUIC?

I am concerned that given a choice the low power proxies will just 
implement forwarded mode with null transform. Do we know proxies that 
will actually use the scrambled transform?

-- Christian Huitema