Re: [quicwg/base-drafts] Forgery limits on packet protection (#3619)

Felix Günther <> Tue, 05 May 2020 12:44 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 831483A040A for <>; Tue, 5 May 2020 05:44:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.098
X-Spam-Status: No, score=-3.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id qSOpgrqCDBI1 for <>; Tue, 5 May 2020 05:44:03 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 72A293A0365 for <>; Tue, 5 May 2020 05:43:45 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id DE81E260195 for <>; Tue, 5 May 2020 05:43:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=pf2014; t=1588682624; bh=MyHf2/2nY99BPzaM0UhtB88VVC5+AIcm2KFtpHQJm6A=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=2axjMBRGW/oQ6BRYX3+hNWGtkHo7EnAisleV5srG+IrWnG/CAYeBYXBzJ9Z/55cwq tenLPfnPhE0iSCEPGk8kz/LJ4yGpTP1vfH6X1Nd1fjg4bQphtPXW0y3JMjSfIQLLXp PU+yrMQKuYrXOmQtUX8LaiUtvSCLI5aeAl+uB6YA=
Date: Tue, 05 May 2020 05:43:44 -0700
From: Felix Günther <>
Reply-To: quicwg/base-drafts <>
To: quicwg/base-drafts <>
Cc: Subscribed <>
Message-ID: <quicwg/base-drafts/issues/3619/>
In-Reply-To: <quicwg/base-drafts/issues/>
References: <quicwg/base-drafts/issues/>
Subject: Re: [quicwg/base-drafts] Forgery limits on packet protection (#3619)
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_5eb15f80998bd_24b63fbc55ecd960583190"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
X-GitHub-Sender: fxguenther
X-GitHub-Recipient: quic-issues
X-GitHub-Reason: subscribed
X-Auto-Response-Suppress: All
Archived-At: <>
X-Mailman-Version: 2.1.29
List-Id: Notification list for GitHub issues related to the QUIC WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 05 May 2020 12:44:04 -0000

I reproduced Martin's analysis of CCM based on [Rogaway's 2011 evaluation]( of the bounds by [Jonsson]( (Myself not being an expert in producing such bounds, I found the second-level confirmation by Rogaway to be helpful.)

I essentially agree with the numbers, except that --when following the same metric as the [AEBounds paper]( the advantage over an ideal PRP (instead of PRF) should be considered. This simply means losing a 1/2 factor in the bound:

**Confidentiality bound:** `(ql)^2 / 2^n`

`q = 2^24.5` yields an advantage of `2^-59`. I'd hence say it's fine to keep TLS 1.3's recommendation on sending max. full-sized `2^24.5` records.

**Integrity bound:** `v/2^t + (l*(v + q))^2 / 2^n`

`v+q <= 2^25.5`, hence `v <= 24.5` yields an advantage of `2^-57` (matching the other analyses).

Most importantly, I concur with Martin that AEAD_AES_128_CCM_8 would need either much lower bounds or a different risk assessment: applying the same limit of `v = 24.5` would bring the advantage incurred through the `v/2^t` bound up to `2^-39.5`.

Would it still be the best approach to define the same anti-forgery limit across all cipher suites, even if this means going down to `2^24.5`?

Of course, I'm happy to discuss more with @ad-l !

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub: