Re: [quicwg/base-drafts] Reference "Nonces are Noticed" in the header protection analysis section (#3031)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.

I think that we're still maybe talking past each other.

> @@ -84,7 +85,7 @@ informative:
       - ins: R. Ng
       - ins: B. Tackmann
     date: 2019-06-01
-    target: https://eprint.iacr.org/2019/624
+    target: "http://dx.doi.org/10.1007/978-3-030-26948-7_9"

With a DOI, you can just cite this as: `{{?NAN=DOI.10.1007/978-3-030-26948-7_9}}` and save all that typing.  Same for the above.

> @@ -1440,12 +1441,13 @@ Header protection uses the output of the packet protection AEAD to derive
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-Assuming hp_key is distinct from the packet protection key, this construction
-(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
-protected packet header. One important distinction between HN1 and the header
-protection construction in this document is that the latter uses an AEAD
-algorithm as the PRF. However, since the encrypted output of an AEAD is
-pseudorandom {{DefnAEAD}}, this achieves the properties desired from a PRF.
+As `hp_key` is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security as defined in {{NAN}} and therefore guarantees
+privacy of `field`, the protected packet header. One important distinction
+between HN1 and the header protection construction in this document is that
+the latter uses an AEAD algorithm as the PRF. However, since the encrypted
+output of an AEAD is pseudorandom {{DefnAEAD}}, this achieves the properties
+desired from a PRF.

This last sentence doesn't wash well for me still.

The reason that we care about the AEAD output being pseudorandom is that this is the way we select the key we use for header protection.  But that is something that the Nonces are Noticed paper should worry about in its proofs.  The important factor for us here is that we are using the HN1 construction properly.  For that, we only need to show that we are using a PRF.  To support that we just need to say that both AES-ECB and ChaCha20 are PRFs.  If that claim needs support, that requires a different paper.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#pullrequestreview-289626822