Re: [quicwg/base-drafts] Define an anti-forgery limit (#3620)

[Christopher Wood <[e-mail]>]

@chris-wood approved this pull request.

Thanks, @martinthomson! I derived the same bounds. This looks good to me.

>  
 Key updates MUST be initiated before usage limits on packet protection keys are
-exceeded.  For the cipher suites mentioned in this document, the limits in
-Section 5.5 of {{!TLS13}} apply.  Other cipher suites MUST define usage limits
-in order to be used with QUIC.
+exceeded. For the cipher suites mentioned in this document, the limits in
+Section 5.5 of {{!TLS13}} apply. {{!TLS13}} does not specify a limit for
+AEAD_AES_128_CCM, but the analysis in {{ccm-bounds}} shows that a limit of 2^23
+packets can be used to obtain the same confidentiality protection as the limits
+specified in TLS.
+
+The usage limits defined in TLS 1.3 exist to provide protection against attacks

```suggestion
The usage limits defined in TLS 1.3 exist for protection against attacks
```

> +packet that cannot be authenticated, allowing multiple attempts at defeating
+integrity protection.

```suggestion
packet that cannot be authenticated, allowing multiple attempts forgery attempts.
```

> +Endpoints MUST count the number of packets that are received but cannot be
+authenticated.  If the number of packets that fail authentication exceeds a

```suggestion
Endpoints MUST count the number of received packets that fail authentication.
If the number of packets that fail authentication exceeds a
```

> +analysis of other AEAD functions in {{AEBounds}}, this analysis assumes a
+packet length of 2^10 blocks and a packet size limit of 2^14.
+
+For AEAD_AES_128_CCM, the total number of block cipher operations is the sum
+of: the length of the associated data in blocks, the length of the ciphertext
+in blocks, the length of the plaintext in blocks, plus 1. In this analysis,
+this is simplified to a value of twice the length of the packet in blocks (that
+is, `2l = 2^11`). This simplification is based on the packet containing all of
+the associated data and ciphertext. This results in a negligible 1 to 3 block
+overestimation of the number of operations.
+
+
+## Confidentiality Limits
+
+For confidentiality, Theorem 2 in {{?CCM-ANALYSIS}} establishes that an
+attacker gains an advantage over an ideal pseudorandom permutation (PRP) of no

```suggestion
attacker gains a distinguishing advantage over an ideal pseudorandom permutation (PRP) of no
```

> +For a target advantage of 2^-60, which matches that used by {{!TLS13}}, this
+results in the relation:
+
+~~~
+q <= 2^23
+~~~
+
+That is, endpoints cannot protect more than 2^23 packets with the same set of
+keys without causing an attacker to gain an larger advantage than the target of
+2^-60.
+
+
+## Integrity Limits
+
+For integrity, Theorem 1 in {{?CCM-ANALYSIS}} establishes that an attacker
+gains an advantage over an ideal PRP of no more than:

```suggestion
gains a distinguishing advantage over an ideal PRP of no more than:
```

> +analysis of other AEAD functions in {{AEBounds}}, this analysis assumes a
+packet length of 2^10 blocks and a packet size limit of 2^14.
+
+For AEAD_AES_128_CCM, the total number of block cipher operations is the sum
+of: the length of the associated data in blocks, the length of the ciphertext
+in blocks, the length of the plaintext in blocks, plus 1. In this analysis,
+this is simplified to a value of twice the length of the packet in blocks (that
+is, `2l = 2^11`). This simplification is based on the packet containing all of
+the associated data and ciphertext. This results in a negligible 1 to 3 block
+overestimation of the number of operations.
+
+
+## Confidentiality Limits
+
+For confidentiality, Theorem 2 in {{?CCM-ANALYSIS}} establishes that an
+attacker gains an advantage over an ideal pseudorandom permutation (PRP) of no

(to clarify that the harm is distinguishability from an ideal PRP, and not plaintext leakage or something.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3620#pullrequestreview-408305716