Re: [quicwg/base-drafts] Forgery limits on packet protection (#3619)

[Martin Thomson <[e-mail]>]

Based on [this paper analysing CCM](https://link.springer.com/content/pdf/10.1007%2F3-540-36492-7_7.pdf) by Jonsson, I have calculated the bounds on the number of forgeries and encryptions for CCM.  The numbers aren't great, but that probably doesn't matter much for the purposes to which CCM is generally put.

(I'm using the notation from the [AEBounds paper](https://www.isg.rhul.ac.uk/~kp/TLS-AEbounds.pdf) here because that is easier to type than some of what is being used in other papers.  For reference, q is the number of genuine encryptions, l is the length of each in 16 byte blocks, v is the number of forgeries, n is the key length in bits, t is the tag length in bits.)

## Confidentiality

Jonsson puts the advantage an attacker has over a generic PRF at `(ql)^2/2^(n+1)`.

If we assume the same numbers in the AEBounds paper for record/packet size, `l=2^10` (this is for consistency, most QUIC packets will be much smaller, in the order of 2^7, but we might also go as high as 2^12; this being dictated by the MTU).  For AES, `n=2^128`.

To keep the advantage an attacker has to 2^-60 (to match the analysis in TLS), we therefore need to keep q to below 2^24.5.  Somewhat unsurprisingly, that matches the numbers we have for AES-GCM.

## Integrity

Jonsson puts the advantage for an attacker over a generic PRF at `v/2^t + (2^l*(v + q))^2/2^(n+1)`.  As the first term is negligible even for large v (up to 2^64), we consider the second term alone and aim for a bound on the advantage of 2^-57 to match the analysis for other ciphers.

That leaves us with `v+q <= 2^26`.  As q is already established to be 2^24.5, we can say that v should be limited to 2^25 (or `log2(2^26 - 2^24.5)` if you want to be precise).

(As a side note, for t=64, as in AEAD_AES_128_CCM_8, the first term becomes relevant and our security bound limits the number of forgeries to 2^7, which is probably a bit limiting in practice.  That's good justification for not enabling AEAD_AES_128_CCM_8 by default; though different applications might use a different target bound than 2^-57.)

## Caveat

I'm an not a cryptographer.  These papers all read like chicken-chicken-chicken.  My calculation

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3619#issuecomment-623224483