Re: [quicwg/base-drafts] Consider simplifying Packet Number Encryption (#1575)

[Kazuho Oku <[e-mail]>]

> I think requiring 3 octets of frames is more restrictive that we need to be. I would prefer saying that QUIC packets MUST verify `length(packet number) + length(payload) >= 4`, and if implementors want to do that by always ensuring 3 bytes of frames that's fine.

This sounds like a neat approach.

> I meant that we XOR over the payload if the packet number length is < 4.

I am not sure if I like the idea. Because it might be an additional complexity to the hardware decoders. In the current design, payload is decrypted only once by an AEAD cipher. This change would mean that it can be decrypted twice, first by a CTR cipher and then by an AEAD cipher.

As @martinthomson points out, we discussed in New York about moving the PN length bits to the first octet. Assuming that we adopt that change, I think there would be no reason to prefer always CTR-decrypting 4 octets. The different is just having a different order between picking the specified length and applying CTR.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1575#issuecomment-426917912