Re: [quicwg/base-drafts] Packet number encryption (#1079)

[Mike Bishop <[e-mail]>]

MikeBishop commented on this pull request.



> +## Packet Number Protection {#pn-encrypt}
+
+QUIC packets are protected using a key that is derived from the current set of
+secrets.  The key derived using the "pn" label is used to protect the packet
+number from casual observation.  The packet number protection algorithm depends
+on the negotiated AEAD.
+
+Packet number protection is applied after packet protection is applied (see
+{{aead}}).  The ciphertext of the packet is sampled and used as input to an
+encryption algorithm.  For packets with a long header, the ciphertext starting
+immediately after the packet number is used (that is, octet 17 onwards).  For
+packets with a short header, the packet number length is not known, so it is
+assumed to be its largest possible length (4 octets).  Thus, for a short header,
+the sampled ciphertext starts at either octet 5 when the connection ID is
+omitted, or octet 13 when the connection is present.
+

Perhaps a client-initiated PATH_CHALLENGE/PATH_RESPONSE should be long header packets?  But that's totally orthogonal to this PR, I think.  So long as the packet number is obscured in both header types, an observer can't tell whether a connection is restarting from zero or not.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1079#discussion_r164584157