[quicwg/base-drafts] Expand AEAD limits to consider multi-user security. (#3789)

[Christopher Wood <[e-mail]>]

Addresses #3788.

In a typical multi-user setting, the adversary is assumed to perform some
(massive) amount of offline work to break the integrity of a single random
connection. Each user is represented as a unique (key, nonce) pair. In
considering the same threat model, we must treat each key resulting from
a KeyUpdate event as a unique user. As a result, roughly speaking, bounds
implied from the multi-user setting imply (minimally) for the lifetime of
a single connection.

Hoang et al. [1] present tight multi-user security bounds for randomized AES-GCM
(as is used in TLS 1.3 and QUIC), so we can take advantage of those for
per-connection integrity limits. (Confidentiality limits still apply per-key, as
the analysis considers only encrypted blocks, which would not change if an endpoint
updated its key or created a new connection.) In contrast, there are no multi-user
security bounds for AEAD_CHACHA20_POLY1305 or AEAD_AES_128_CCM, so we must use the
single-user bounds in their stead.

[1] https://dl.acm.org/doi/10.1145/3243734.3243816
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3789

-- Commit Summary --

  * Expand AEAD limits to consider multi-user security.

-- File Changes --

    M draft-ietf-quic-tls.md (176)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3789.patch
https://github.com/quicwg/base-drafts/pull/3789.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3789