Re: [quicwg/base-drafts] Reference "Nonces are Noticed" in the header protection analysis section (#3031)

[Martin Thomson <[e-mail]>]

martinthomson commented on this pull request.

I like the Nonces paper.  That validates a lot of what we have previously only theorized.

> -    date: 2014-11-06
-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20
+    target: "https://web.cs.ucdavis.edu/~rogaway/papers/ad.pdf"
+
+  NAN:
+    title: "Nonces are Noticed: AEAD Revisited"
+    author:
+      - ins: M. Bellare
+      - ins: R. Ng
+      - ins: B. Tackmann
+    date: 2019-06-01
+    target: https://eprint.iacr.org/2019/624
+    seriesinfo: Advances in Cryptology – CRYPTO 2019, pages 235-265

So this is not the same paper (the link references a full paper of which the CRYPTO 2019 piece was just a preview).  Not sure how to thread that.

Will the CRYPTO version have a DOI that we can use?

>      author:
-      - ins: J. Katz
-      - ins: Y. Lindell
-    date: 2014-11-06
-    seriesinfo:
-      ISBN: 978-1466570269
+      - ins: P. Rogaway
+    date: 2002-09-20
+    target: "https://web.cs.ucdavis.edu/~rogaway/papers/ad.pdf"

This has the same property as the one below, except that you don't cite the proceedings:

> [21] P. Rogaway. Authenticated-encryption with associated-data.Ninth ACM Conference onComputer and Communications Security(CCS-9). ACM Press, 2002. Proceedings version of this paper

>  
 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction

This isn't an assumption, it's a property we provide.

```suggestion
As `hp_key` is distinct from the packet protection key, this construction
```

>  
 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the

I would expand this to cite {{NAN}} again.

```suggestion
(HN1) achieves AE2 security as defined in {{NAN}} and therefore guarantees privacy of `field`, the
```

>  
 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
+protected packet header. One important distinction between HN1 and the header
+protection construction in this document is that the latter uses an AEAD
+algorithm as the PRF. However, since the encrypted output of an AEAD is

I'm not sure that the distinction this middle sentence makes is relevant.  The definition of HN1 only depends on F being a PRF.  The existing header protection functions use a PRF.  We should probably say something about what it takes to define a new header protection scheme somewhere though.

>  
 ~~~
 protected_field = field XOR PRF(hp_key, sample)
 ~~~
 
-This construction is secure against chosen plaintext attacks (IND-CPA) {{IMC}}.
+Assuming hp_key is distinct from the packet protection key, this construction
+(HN1) achieves AE2 security and therefore guarantees privacy of `field`, the
+protected packet header. One important distinction between HN1 and the header
+protection construction in this document is that the latter uses an AEAD
+algorithm as the PRF. However, since the encrypted output of an AEAD is
+pseudorandom {{DefnAEAD}}, this achieves the properties desired from a PRF.

I don't think that you need to cite Rogaway's paper here.  We're not relying on the properties of an AEAD (the HN1 construction was, so it might be a little misleading to skew that direction).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3031#pullrequestreview-288407951