Re: [quicwg/base-drafts] Include epoch in the AAD or the nonce? (#3661)

[Felix Günther <[e-mail]>]

As already mentioned, there's little analytical support regarding key updates in QUIC (and DTLS), including [our analysis](https://www.felixguenther.info/docs/QUIPS2020_RobustChannels.pdf). As stated for DTLS, my understanding is that some form of authentication of the epoch number would be helpful for a clean analysis.

My thought is: with QUIC's current approach, you could _in principle_ have that the key+IV across two epochs collide, which then would mean you can replay packets across those two epochs. If the epoch is authenticated through the AAD, that's prevented. With XOR-ing into the nonce it's more messy, as now you could have a colliding IV 'cancel out' the XOR (the same affects DTLS, actually).

That said, I would expect the concrete loss for key+IV collisions to probably be an additional birthday-bound term in the order of  #epochs^2 / 2^{|key|+|IV|}. Here, I am thinking of #epochs = number of epochs in a connection, coming from an/our analysis viewpoint on the full channel. In extending that to multiple keys one would usually want to abstract out key generation and assume key/IV across all epochs to be independent, hence the birthday bound.

Martin pointed out to me that (a) #epochs might be reduced to the number of currently active epochs (2-3), and (b) |IV| might be too much due to the sequence number range, which may lead to nonce collisions between ranges.

So, overall, while having the epochs in the AAD might be cleaner from an analysis point of view, I don't have a strong basis for that and think no-change likely comes with a small loss only in comparison.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3661#issuecomment-638005491