Re: [quicwg/base-drafts] Expand AEAD limits to consider multi-user security. (#3789)

[Martin Thomson <[e-mail]>]

@martinthomson commented on this pull request.



> @@ -2207,10 +2206,14 @@ v:
   bound on the number of forged packets that an endpoint can reject before
   updating keys.
 
-The analysis of AEAD_AES_128_CCM relies on a count of the number of block
-operations involved in producing each message. For simplicity, and to match the
-analysis of other AEAD functions in {{AEBounds}}, this analysis assumes a
-packet length of 2^10 blocks and a packet size limit of 2^14.
+o:
+
+: The amount of offline ideal cipher queries made by an adversary.
+
+The analyses that follow rely on a count of the number of block operations
+involved in producing each message. For simplicity, and to match the analysis of
+other AEAD functions in {{AEBounds}}, this analysis assumes a packet length of
+2^10 blocks; that is, a packet size limit of 2^14 bytes.

We decided that matching the TLS analysis in this regard is best.  Using the larger number is more conservative, so the margins in practice will be better than what we have calculated here.

There is of course the theoretical limit on QUIC packets, which is 2^16 bytes or 2^12 blocks, but as you say, they are mostly much smaller.  There is an existing note about this discrepancy for those running a massive MTU.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3789#discussion_r445928115