Re: [quicwg/base-drafts] Why does stateless reset have to be checked after MAC failure (#2152)

[Martin Thomson <[e-mail]>]

I imagine this to be much simpler than you suggest.  An endpoint that sends packets using a given set of connection IDs puts all the associated stateless reset tokens into a structure.  Then along with decrypting packets, it iterates through that structure and performs a constant time comparison with each.  That's something that won't have weird cache usage patterns, other than the usual cost of getting these values into the cache if they fall out.  The number of active values shouldn't be a secret, which is most of what that tells you.

The result of this will be two Boolean values: whether the AEAD was OK and whether the stateless reset was triggered.  An authentic packet will be the logical OR of those two values.  Anything else is dropped.  After that point, you have crossed into packets being "good", so the time you take to process the packet is less of a concern.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2152#issuecomment-524824568