[quicwg/base-drafts] ed9bbf: Update AEAD limits

Martin Thomson <noreply@github.com> Mon, 06 July 2020 06:58 UTC

Date: Sun, 05 Jul 2020 23:58:10 -0700
From: Martin Thomson <noreply@github.com>
To: quic-issues@ietf.org
Message-ID: <quicwg/base-drafts/push/refs/heads/aead-limits2/5e7bfa-ed9bbf@github.com>
Subject: [quicwg/base-drafts] ed9bbf: Update AEAD limits
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/73ULpTh4GVb9BnfRf3x_gJvA9U0>
Precedence: list

  Branch: refs/heads/aead-limits2
  Home:   https://github.com/quicwg/base-drafts
  Commit: ed9bbfc7a712b67466842abef03932dbf369dc1e
      https://github.com/quicwg/base-drafts/commit/ed9bbfc7a712b67466842abef03932dbf369dc1e
  Author: Martin Thomson <mt@lowentropy.net>
  Date:   2020-07-06 (Mon, 06 Jul 2020)

  Changed paths:
    M draft-ietf-quic-tls.md

  Log Message:
  -----------
  Update AEAD limits

This corrects an arithmetic error in the calculation of the
confidentiality limit for AES-GCM.

It also changes to using a fixed advantage target of 2^-57 for both
confidentiality and integrity.  The inconsistent use of different limits
was making it hard to reason about.  As the overall target is AE
security, the net effect of this is a factor of 2 improvement in
attacker advantage over what is in the TLS analysis, which was
2^-57+2^-60.  This moves to 2^-56 overall, which is cleaner.

In doing so, I discovered that the integrity limits for both AES-GCM and
AES-CCM were being set independent of the confidentiality limits, but
that the confidentiality limits assumed limits on the number of
forgeries.  As a result, the limits on forgeries had to be capped based
on those assumptions.

[quicwg/base-drafts] ed9bbf: Update AEAD limits Martin Thomson