Re: [quicwg/base-drafts] Remove the explicit packet number gap in favor of one computed (#496)

[janaiyengar <[e-mail]>]

janaiyengar commented on this pull request.

A couple of comments

>  between two points of network attachment.
 
-The NEW_CONNECTION_ID message includes a connection ID that the client can use
-for packets on the current connection.  This message also includes packet number
-gap, which is the number of packet numbers that the client skips when using the
-new connection ID.  Without this, the packet number field in the header might be
-used to link activity across networks.  A server MUST provide a 32-bit value for
-the packet number gap field that is indistinguishable from random to a passive
-observer.
+A client which wishes to break linkability upon changing networks MUST
+use the NEW_CONNECTION_ID as well as incrementing the packet sequence

The MUST is unclear. I'm not sure how to read it -- is this a requirement of the spec? Seems not, since according to the text, a client may choose to not break linkability. Perhaps using lowercase "must" is what you want here?

> @@ -1296,6 +1291,22 @@ connection ID, it should expect packets on the new connection ID to start at 18.
 A packet with the new connection ID and a packet number of 17 is discarded as
 being in error.
 
+#### Packet Number Gap
+
+In order to avoid linkage, the packet number gap MUST be externally
+indistinguishable from random. The packet number gap for a connection
+ID with sequence number is computed by encoding the sequence number
+as a 32-bit integer in big-endian format, and then computing:
+
+~~~
+Gap = HKDF-Expand-Label(packet_number_secret,
+                        "QUIC packet sequence gap", sequence, 4)

HKDF-Expand-Label is not defined in the transport draft. This should be one more addition to the QUIC-TLS API. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/496#pullrequestreview-36161486