Re: [quicwg/base-drafts] Short header reserved bits: make available for unilateral experimentation (#2022)

[Mike Bishop <[e-mail]>]

I think I see the issue, though we're skirting the outer edges of my crypto here, so I'd like to confirm.  The cheap way to deal with this would *seem* to be taking those two extra masking bits from the packet number protection and using them to mask off the bits iff you're not using them.  But that doesn't work, because you don't have the PNP mask until after you've committed to a value.

The pre-masking value (currently required to be 0) is in the AAD, which influences the output of the AEAD tag (and the ciphertext?).  The sampled input for packet number protection can come from the AEAD tag, so anything that modifies the AAD potentially modifies the PNP mask.

To validate, the recipient would need to generate the PNP mask, then check the packet against the authentication tag for both the bits-as-received and the bits-as-would-have-been-masked, then accept the packet if either were valid.  (Since we're talking about two bits, there's also a ~33% chance that if someone on the network decided to fiddle those bits, the recipient would decide it was still okay.)

In order to avoid trial decryption and undetected meddling, the recipient has to know whether to unmask those bits before validating the packet or not.  Either we declare them unmasked and random-if-not-used, which entails an extra CSPRNG call for those two bits in the non-experiment case; or we declare them masked unless the peers negotiate otherwise.  (The value pre-masking doesn't actually matter, but since the network can't observe it, it's useless for these experiments.)

Did I get all that?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2022#issuecomment-440402331