Re: [quicwg/base-drafts] First pass at 7, 14, and 30-bit varint packet numbers (#1334)

[Brian Trammell <[e-mail]>]

>I'm not really sure why overdecrypting as opposed to one at a time would make things any worse if the output is not visible to any observer

ISTM either choice is an implementation detail, and can be left out here. Indeed, while always decrypting four octets is an easy way to go constant-time, it's not the only one. OTOH, the probable length of the encoded PN can already be deduced by anyone along the path with even the dimmest idea of the window size: if someone's willing to perform timing attacks to recover information they should already have, more power to them.

I'll roll all this up into another commit later today.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1334#issuecomment-386596385