Re: [quicwg/base-drafts] Clarify Actions on nonzero Reserved Bits (#2280)

[Kazuho Oku <[e-mail]>]

@ianswett 
> Saying they have to be 0 invites people to short-cut the full decryption and drop packets that have other values immediately.

Honestly speaking, I am not sure short-cutting in case the zero check fails would lead to side channel vulnerability, considering the fact that a failed check immediately ends up in connection termination. The only information an attacker can obtain is that the sender failed to set the bits correctly.

Anyways, I do not think that removing the zero-check dissolves the vulnerability to the side-channel attack, because any use of the bits protected by header protection prior to AEAD-decrypting the payload is forbidden. The real attack exists on the PN field, where an attacker can flip the bits of the encrypted PN and use the timing difference of the receiver that short-cuts AEAD decryption based on the value of the PN to infer what the value of the unprotected PN was.

Therefore, I think that we should spend our effort to be clear about when the unprotected header bits can be used, rather than trying to fixing a use-case that does not have a high impact.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2280#issuecomment-453087410