Re: [quicwg/base-drafts] Mask packet numbers with a per-connection-ID key (#1043)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.



> -indistinguishable from random. The packet number gap for a connection
-ID with sequence number is computed by encoding the sequence number
-as a 32-bit integer in big-endian format, and then computing:
-
-~~~
-Gap = HKDF-Expand-Label(packet_number_secret,
-                        "QUIC packet sequence gap", sequence, 4)
-~~~
-
-The output of HKDF-Expand-Label is interpreted as a big-endian
-number. "packet_number_secret" is derived from the TLS key exchange,
-as described in Section 5.6 of {{QUIC-TLS}}.
+connection ID provided by the server.  Using a new connection ID will produce a
+new packet protection key and IV.  New values for obscuring header fields (see
+{{header-obscuring}}) ensure that packet numbers can't be used to link activity
+on paths that use different connection IDs.
 

It can't be optional if it is to be interoperable.

I'm not sure which point Ian was making.  If you lose connection ID and the address tuple changes, you are lost, but either of those can be enough to recover.  The address tuple is only sufficient if the server isn't routing based on connection ID though, and we expect that to be quite common.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1043#discussion_r160344942