Date: Tue, 05 May 2020 05:43:44 -0700
From: =?UTF-8?B?RmVsaXggR8O8bnRoZXI=?= <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+AFTOJK5YDP2DCY2MEQPIC3F4XVAIBEVBNHHCIZC2Y4@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/3619/624032621@github.com>
In-Reply-To: <quicwg/base-drafts/issues/3619@github.com>
References: <quicwg/base-drafts/issues/3619@github.com>
Subject: Re: [quicwg/base-drafts] Forgery limits on packet protection (#3619)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5eb15f80998bd_24b63fbc55ecd960583190";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/raOw9rWLRWftgNd9iJCslnRzbO0>


----==_mimepart_5eb15f80998bd_24b63fbc55ecd960583190
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

I reproduced Martin's analysis of CCM based on [Rogaway's 2011 evaluation](https://crossbowerbt.github.io/docs/crypto/rogaway_modes.pdf) of the bounds by [Jonsson](https://link.springer.com/content/pdf/10.1007%2F3-540-36492-7_7.pdf). (Myself not being an expert in producing such bounds, I found the second-level confirmation by Rogaway to be helpful.)

I essentially agree with the numbers, except that --when following the same metric as the [AEBounds paper](https://www.isg.rhul.ac.uk/~kp/TLS-AEbounds.pdf)-- the advantage over an ideal PRP (instead of PRF) should be considered. This simply means losing a 1/2 factor in the bound:

**Confidentiality bound:** `(ql)^2 / 2^n`

`q = 2^24.5` yields an advantage of `2^-59`. I'd hence say it's fine to keep TLS 1.3's recommendation on sending max. full-sized `2^24.5` records.


**Integrity bound:** `v/2^t + (l*(v + q))^2 / 2^n`

`v+q <= 2^25.5`, hence `v <= 24.5` yields an advantage of `2^-57` (matching the other analyses).


Most importantly, I concur with Martin that AEAD_AES_128_CCM_8 would need either much lower bounds or a different risk assessment: applying the same limit of `v = 24.5` would bring the advantage incurred through the `v/2^t` bound up to `2^-39.5`.


Would it still be the best approach to define the same anti-forgery limit across all cipher suites, even if this means going down to `2^24.5`?


Of course, I'm happy to discuss more with @ad-l !

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3619#issuecomment-624032621
----==_mimepart_5eb15f80998bd_24b63fbc55ecd960583190
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<p></p>
<p>I reproduced Martin's analysis of CCM based on <a href="https://crossbowerbt.github.io/docs/crypto/rogaway_modes.pdf" rel="nofollow">Rogaway's 2011 evaluation</a> of the bounds by <a href="https://link.springer.com/content/pdf/10.1007%2F3-540-36492-7_7.pdf" rel="nofollow">Jonsson</a>. (Myself not being an expert in producing such bounds, I found the second-level confirmation by Rogaway to be helpful.)</p>
<p>I essentially agree with the numbers, except that --when following the same metric as the <a href="https://www.isg.rhul.ac.uk/~kp/TLS-AEbounds.pdf" rel="nofollow">AEBounds paper</a>-- the advantage over an ideal PRP (instead of PRF) should be considered. This simply means losing a 1/2 factor in the bound:</p>
<p><strong>Confidentiality bound:</strong> <code>(ql)^2 / 2^n</code></p>
<p><code>q = 2^24.5</code> yields an advantage of <code>2^-59</code>. I'd hence say it's fine to keep TLS 1.3's recommendation on sending max. full-sized <code>2^24.5</code> records.</p>
<p><strong>Integrity bound:</strong> <code>v/2^t + (l*(v + q))^2 / 2^n</code></p>
<p><code>v+q &lt;= 2^25.5</code>, hence <code>v &lt;= 24.5</code> yields an advantage of <code>2^-57</code> (matching the other analyses).</p>
<p>Most importantly, I concur with Martin that AEAD_AES_128_CCM_8 would need either much lower bounds or a different risk assessment: applying the same limit of <code>v = 24.5</code> would bring the advantage incurred through the <code>v/2^t</code> bound up to <code>2^-39.5</code>.</p>
<p>Would it still be the best approach to define the same anti-forgery limit across all cipher suites, even if this means going down to <code>2^24.5</code>?</p>
<p>Of course, I'm happy to discuss more with <a class="user-mention" data-hovercard-type="user" data-hovercard-url="/users/ad-l/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ad-l">@ad-l</a> !</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/quicwg/base-drafts/issues/3619#issuecomment-624032621">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AFTOJK6VPTHRGSZJVZZNGRLRQACYBANCNFSM4MW3IVFA">unsubscribe</a>.<img src="https://github.com/notifications/beacon/AFTOJKY5ACMATKV4DYJGP3LRQACYBA5CNFSM4MW3IVFKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEUY7W3I.gif" height="1" width="1" alt="" /></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/3619#issuecomment-624032621",
"url": "https://github.com/quicwg/base-drafts/issues/3619#issuecomment-624032621",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>
----==_mimepart_5eb15f80998bd_24b63fbc55ecd960583190--