Re: [quicwg/base-drafts] Improve ACK_ECN frame encoding (e.g., use bit-vector) (#1439)

[Antoine Delignat-Lavaud <[e-mail]>]

Throwing away a packet after decrypting its packet number is quite clearly forbidden by the spec.

>   An attacker can guess values for packet numbers and have an endpoint
>   confirm guesses through timing side channels.  If the recipient of a
>   packet discards packets with duplicate packet numbers without
>   attempting to remove packet protection they could reveal through
>   timing side-channels that the packet number matches a received
>   packet.  For authentication to be free from side-channels, the entire
>   process of packet number protection removal, packet number recovery,
>   and packet protection removal MUST be applied together without timing
>   and other side-channels.

This text is there for a reason - packet number encryption (which is already very brittle) becomes mostly useless if you do this. In any case, @kazuho ECN proposal does not require packet deduplication from what I understand.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1439#issuecomment-397323088