Re: [quicwg/base-drafts] Include epoch in the AAD or the nonce? (#3661)

[Martin Thomson <[e-mail]>]

Kazuho, you have the gist of it.  There is no material performance impact.  The base nonce that you xor the packet number with is still constant.  But the theory would be that you don't get confusion about which epoch was used.  The counter-argument being that the keys (and the nonce) should be completely different anyway.

As you can see, the concern is that there is a risk inherent.

As for divergences, it's not divergent from DTLS, which is where this is coming from.  Because the analytical framework for the record/packet layer in DTLS is more similar to QUIC, that makes this somewhat more compelling.

All that said, I'm inclined toward no action myself, but I want that to have a firmer basis than we currently have.  I am prepared to accept that we won't get that though, in which case we will just have to make a call.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3661#issuecomment-637199156