[quicwg/base-drafts] Forgery attacks and updated keys (#3662)

[Martin Thomson <[e-mail]>]

@chris-wood pointed out to me that when you receive junk (i.e., unauthenticated) packets, the odds are that these will be distributed evenly between the "current" packet protection keys and the "next" packet protection keys, as the key phase bit will be nearly random if they are true forgeries.

The result is that an endpoint that approaches the integrity limit on key usage will update to the next packet protection keys and find that those keys will have similar amounts of authentication failures.  That might lead to needing two updates in quick succession.  That isn't fatal, but if the timing is tight, then more time might be needed for an update.

We might say that endpoints shouldn't be calculating the forgery rate and trying to delay updates as late as possible, nor should they be allowing that many forgeries without doing anything but react with key updates.  However, as a matter of good hygiene, it's worth saying something about this.

Taking this as an editorial follow-on to #3620.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3662