Re: [quicwg/base-drafts] Reference "Nonces are Noticed" in the header protection analysis section (#3031)

[Christopher Wood <[e-mail]>]

chris-wood commented on this pull request.



>  
 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
+protected packet header. One important distinction between HN1 and the header
+protection construction in this document is that the latter uses an AEAD
+algorithm as the PRF. However, since the encrypted output of an AEAD is

I think the distinction is important because AEADs are (depending on one's definition) not PRFs. 

> We should probably say something about what it takes to define a new header protection scheme somewhere though.

Hmm, I'm not sure. That's probably best done elsewhere, e.g., a CFRG document, that we then cite. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324680042