[quicwg/base-drafts] Packet protection keys not CID-based (#1267)

[Mike Bishop <[e-mail]>]

@igorlord proposed a possible strategy to mitigate timing attacks / gaps in observable packet numbers from different CIDs, particularly in the case of random offsets per CID.  He would send identical packet payload, modulo some PADDING to avoid them being identically-sized, under the same packet number with different CIDs and a random delay on one of them.  An observer would no longer see matching gaps between packets from two different CIDs and be able to probabilistically correlate them as easily.  The receiver, seeing a duplicate packet number, will discard whichever arrives later.

This doesn't appear to work in the current packet protection scheme because, post-handshake, the packet protection keys don't mix in the connection ID, as far as I can tell.  That means identical packet numbers produce identical IVs and compromise the payload of the packets (assuming the observer can correlate them some other way).

However, if the packet protection secrets were derived from the Connection ID as well as the TLS exporter value, then identical packet numbers on different CIDs would not be a security issue.  This might also be a necessary property if we pursue per-CID packet number spaces.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1267