Re: New confidentiality and integrity limits

[Martin Thomson <[e-mail]>]

On Thu, Jul 16, 2020, at 11:40, Watson Ladd wrote:
> I do not believe the analysis is correct.
> 
> A forgery against a QUIC connection will be checked at one or at most
> two keys: the current one and the next one. It is not the case that a
> forgery will be attempted against all the keys simultaneously: it will
> have to be resent. Perhap I'm missing something about the setting here
> that makes this the multiuser and not the singleuser setting.

Thanks for checking Watson.

I had exactly the same thought, but was convinced by Felix that the analysis was based on a definition that only considers the number of encryption/verification queries in total. In particular, that the values in results are not limited in any way by which subset of the keys could be tried.

Incidentally, that also supports the view that there is degradation in the confidentiality advantage as you update to different keys.  I note that the PR does not acknowledge this, but maybe it should.

I confess that I'm still not completely confident that the multiuser setting is a good fit for our needs (or even that the threat model is the right one).  This is, in part of the reason you state: the mu setting assumes that the attacker has equal access to all "users" concurrently and the limited number of active keys would seem to make that difficult to exploit.  But I don't know how to prove that this is an acceptable assumption.

What I am confident about is that a conservative approach doesn't hurt a great deal here.  The calculated limits for GCM are high enough - even under the assumptions made - that you have serious problems if you hit them.