Re: [quicwg/base-drafts] Define an anti-forgery limit (#3620)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> +integrity protections in authenticated encryption also depend on limiting the
+number of attempts to forge packets. TLS achieves this by closing connections
+after any record fails an authentication check. In comparison, QUIC ignores any
+packet that cannot be authenticated, allowing multiple attempts at defeating
+integrity protection.
+
+Endpoints MUST count the number of packets that are received but cannot be
+authenticated. Packet protection keys MUST NOT be used for removing packet
+protection after authentication fails on more than a limit that is specific to
+the AEAD in use. Endpoints MUST initiate a key update before reaching this
+limit. Applying a limit reduces the probability that an attacker is able to
+successfully forge a packet; see {{AEBounds}} and {{ROBUST}}.
+
+For AEAD_AES_128_GCM, AEAD_AES_256_GCM, and AEAD_CHACHA20_POLY1305, if the
+number of packets that fail authentication exceeds 2^36, the endpoint MUST
+immediately close the connection.  Note that the analysis in {{AEBounds}}

I see. Thank you for the clarification.

Then, I think that the text could become less confusing if we move "MUST close the connection" to the paragraph above, and change this paragraph to just listing the numbers.

For example, the paragraph above can be changed to something like:
_Endpoints MUST count the number of packets that are received but cannot be authenticated. If the number of packets that fail authentication exceeds a limit that is specific to the AEAD in use, the endpoint MUST immediately close the connection. Endpoints MUST initiate a key update before reaching this limit. Applying a limit reduces the probability that an attacker is able to successfully forge a packet; see {{AEBounds}} and {{ROBUST}}._

_For AEAD_AES_128_GCM, AEAD_AES_256_GCM, and AEAD_CHACHA20_POLY1305, the limit on the number of packets that fail authentication is 2^36..._

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3620#discussion_r421871212