Re: [quicwg/base-drafts] Forgery limits on packet protection (#3619)

[Felix Günther <[e-mail]>]

I reproduced Martin's analysis of CCM based on [Rogaway's 2011 evaluation](https://crossbowerbt.github.io/docs/crypto/rogaway_modes.pdf) of the bounds by [Jonsson](https://link.springer.com/content/pdf/10.1007%2F3-540-36492-7_7.pdf). (Myself not being an expert in producing such bounds, I found the second-level confirmation by Rogaway to be helpful.)

I essentially agree with the numbers, except that --when following the same metric as the [AEBounds paper](https://www.isg.rhul.ac.uk/~kp/TLS-AEbounds.pdf)-- the advantage over an ideal PRP (instead of PRF) should be considered. This simply means losing a 1/2 factor in the bound:

**Confidentiality bound:** `(ql)^2 / 2^n`

`q = 2^24.5` yields an advantage of `2^-59`. I'd hence say it's fine to keep TLS 1.3's recommendation on sending max. full-sized `2^24.5` records.


**Integrity bound:** `v/2^t + (l*(v + q))^2 / 2^n`

`v+q <= 2^25.5`, hence `v <= 24.5` yields an advantage of `2^-57` (matching the other analyses).


Most importantly, I concur with Martin that AEAD_AES_128_CCM_8 would need either much lower bounds or a different risk assessment: applying the same limit of `v = 24.5` would bring the advantage incurred through the `v/2^t` bound up to `2^-39.5`.


Would it still be the best approach to define the same anti-forgery limit across all cipher suites, even if this means going down to `2^24.5`?


Of course, I'm happy to discuss more with @ad-l !

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3619#issuecomment-624032621