Re: [quicwg/base-drafts] First octet changes (#2006)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> +Before a TLS ciphersuite can be used with QUIC, a header protection algorithm
+MUST be specified for the AEAD used with that ciphersuite.  This document
+defines algorithms for AEAD_AES_128_GCM, AEAD_AES_128_CCM, AEAD_AES_256_GCM,
+AEAD_AES_256_CCM (all AES AEADs are defined in {{!AEAD=RFC5116}}), and
+AEAD_CHACHA20_POLY1305 {{!CHACHA=RFC8439}}.
+
+
+### Header Protection Sample {#hp-sample}
+
+The header protection algorithm uses both the header protection key and a sample
+of the ciphertext from the packet Payload field.
+
+The same number of bytes are always sampled, but an allowance needs to be made
+for the endpoint removing protection, which will not know the length of the
+Packet Number field.  In sampling the packet ciphertext, the Packet Number field
+is assumed to be 4 bytes long (its maximum possible encoded length), unless

@mikkelfj I tend to agree that 128 bits will be enough (because PN space is 62 bits and IV needs to be indistinguishable from random), but I think we might want to define the number for each cipher-suite.

@marten-seemann The reason we introduced PNE was to prevent packet numbers sent in clear as a tracking vector among multiple CIDs of a connection (that possibly roams). As you state, IV collision leaks the XOR between two packet numbers. The risk of that being used as a tracking vector will become higher as the chance of collision arises.

Anyways, I think that requiring `length(packet number) + length(payload) >= 4 + length(iv) - length(aead tag)` would be a good idea, because it is a simplification at the same time giving us agility against cipher-suites that we might add in the future. Current spec requires both the encoder and decoder to adjust the position of IV if the payload length is below 4. The proposed change concentrates the adjustment into one point; i.e. when encoder builds the payload.

FWIW, for the cipher-suites that are defined now, the right-hand side of the expression (i.e. `4 + length(iv) - length(aead tag)`) is always 4, which makes the equation exactly the same as what @DavidSchinazi suggests.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2006#discussion_r234394614