Re: [quicwg/base-drafts] Consider simplifying Packet Number Encryption (#1575)

[David Schinazi <[e-mail]>]

I had a conversation with @ekr about this yesterday, and I'm wondering if the following proposal might get us the best of both worlds:
1) Require that QUIC packets MUST verify `length(packet number) + length(payload) >= 4`, by padding the payload if needed.
2) Always have PNE encrypt 4 bytes from the start of the packet number, and use the following 16 bytes as nonce.

In practice the padding overhead here is very low as it only impacts a small number of frame types when sent without an ACK frame. (Worse case scenario is a lonely PING frame with packet number below 63, and that case suffers 2 bytes of padding out of a 20+8+1+1+1=31 byte IPv4 packet)

It also has the nice property of obfuscating the packet-number length, as an observer can no longer tell when the packet number is below 63.

In terms of implementation, this is simplest for decryption, and the padding can be added right before encrypting the payload as that code needs to have access to the packet number as nonce anyway.

What are people's thoughts on this?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1575#issuecomment-424144509