Re: [quicwg/base-drafts] Include epoch in the AAD or the nonce? (#3661)

[Martin Thomson <[e-mail]>]

As Kazuho says, the short value is covered by the AAD; it's only the full value that we need to worry about.

This is only an intuition, but my expectation is that the analysis offered in https://www.felixguenther.info/docs/QUIPS2020_RobustChannels.pdf could extend to epochs.  That is, the packet contains the key phase, which is analogous to the packet number.  Endpoints only accept packets within a very narrow window.  For packet numbers, this is determined by the length of the packet number encoding in that analysis; for epochs, this would be the two epochs you keep live, which matches the length of the key phase.  I can make an argument that keeping the number of keys less than the number of epoch values is no worse than one key and no encoded epoch values.

That's not formal though; there might be a trick needed to resolve the odd loop where the value you are relying on is authenticated by the key that it identifies (I don't see that question being addressed in the referenced thread).

The question for me is whether you believe that this requires formal analysis.  Obviously it would be great if someone could find a way to subject this to more formal analysis, but we need to determine how much of a deal-breaker this could be.

Folks in TLS seem to be pushing toward adding more to the AAD, but that doesn't seem to be well supported by anything other than an excess of caution in the absence of any real analysis.  I don't think we should change something without formal analysis supporting additional measures.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3661#issuecomment-629888016