Re: [quicwg/base-drafts] Reference "Nonces are Noticed" in the header protection analysis section (#3031)

[Christopher Wood <[e-mail]>]

chris-wood commented on this pull request.



>  
 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
+protected packet header. One important distinction between HN1 and the header
+protection construction in this document is that the latter uses an AEAD
+algorithm as the PRF. However, since the encrypted output of an AEAD is
+pseudorandom {{DefnAEAD}}, this achieves the properties desired from a PRF.

Rogaway's definition assumes the encrypted output is pseudorandom (per the Adv^PRIV requirement), and that's the property header protection relies on, so I felt it best to cite.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#discussion_r324680607